Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

filebeat/module/crowdstrike: fix LocalIP and UserIP with N/A value #32896

Merged
merged 5 commits into from
Oct 25, 2022
Merged

filebeat/module/crowdstrike: fix LocalIP and UserIP with N/A value #32896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cbf7d7e
fix LocalIP and UserIP with N/A value
elauqsap Aug 26, 2022
8fc265a
address change suggestions and requests
elauqsap Aug 29, 2022
4a4ba5d
fixes for tests
elauqsap Aug 30, 2022
29c78cf
missing newline
elauqsap Aug 30, 2022
0c6e477
Merge branch 'main' into cs-ingest-patch
andrewkroh Oct 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
- httpjson input: Add request tracing logger. {issue}32402[32402] {pull}32412[32412]
- Add cloudflare R2 to provider list in AWS S3 input. {pull}32620[32620]
- Add support for single string containing multiple relation-types in getRFC5988Link. {pull}32811[32811]
- Fix handling of invalid UserIP and LocalIP values. {pull}32896[32896]

*Auditbeat*

Expand Down
3 changes: 1 addition & 2 deletions x-pack/filebeat/module/crowdstrike/falcon/ingest/auth_activity_audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,9 @@ processors:
- convert:
field: crowdstrike.event.UserIp
target_field: source.ip
type: string
type: ip
ignore_missing: true
ignore_failure: true
if: ctx?.crowdstrike?.event?.UserIp != null && ctx?.crowdstrike?.event?.UserIp != ""
- script:
lang: painless
source: |
Expand Down
3 changes: 1 addition & 2 deletions x-pack/filebeat/module/crowdstrike/falcon/ingest/detection_summary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,9 @@ processors:
- convert:
field: crowdstrike.event.LocalIP
target_field: source.ip
type: string
type: ip
ignore_failure: true
ignore_missing: true
if: ctx?.crowdstrike?.event?.LocalIP != null && ctx?.crowdstrike?.event?.LocalIP != ""
- convert:
field: crowdstrike.event.ProcessId
target_field: process.pid
Expand Down
3 changes: 1 addition & 2 deletions x-pack/filebeat/module/crowdstrike/falcon/ingest/user_activity_audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ processors:
- convert:
field: crowdstrike.event.UserIp
target_field: source.ip
type: string
type: ip
ignore_failure: true
ignore_missing: true
if: ctx?.crowdstrike?.event?.UserIp != null && ctx?.crowdstrike?.event?.UserIp != ""
17 changes: 17 additions & 0 deletions x-pack/filebeat/module/crowdstrike/falcon/test/falcon-audit-events.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,3 +275,20 @@
"UTCTimestamp": 1581603262
}
}
{
"metadata": {
"customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b",
"offset": 9,
"eventType": "AuthActivityAuditEvent",
"eventCreationTime": 1581601820289,
"version": "1.0"
},
"event": {
"UserId": "alice@company.com",
"UserIp": "N/A",
"OperationName": "selfAcceptEula",
"ServiceName": "CrowdStrike Authentication",
"Success": true,
"UTCTimestamp": 1581601820289
}
}
39 changes: 39 additions & 0 deletions x-pack/filebeat/module/crowdstrike/falcon/test/falcon-audit-events.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -631,5 +631,44 @@
],
"user.email": "alice@company.com",
"user.name": "alice@company.com"
},
{
"crowdstrike.event.OperationName": "selfAcceptEula",
"crowdstrike.event.ServiceName": "CrowdStrike Authentication",
"crowdstrike.event.Success": true,
"crowdstrike.event.UTCTimestamp": "2020-02-13T13:50:20.289Z",
"crowdstrike.event.UserId": "alice@company.com",
"crowdstrike.metadata.customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b",
"crowdstrike.metadata.eventCreationTime": "2020-02-13T13:50:20.289Z",
"crowdstrike.metadata.eventType": "AuthActivityAuditEvent",
"crowdstrike.metadata.offset": 9,
"crowdstrike.metadata.version": "1.0",
"event.action": "self_accept_eula",
"event.category": [
"authentication"
],
"event.dataset": "crowdstrike.falcon_audit",
"event.kind": "event",
"event.module": "crowdstrike",
"event.outcome": "success",
"event.type": [
"change"
],
"fileset.name": "falcon",
"input.type": "log",
"log.flags": [
"multiline"
],
"log.offset": 8094,
"message": "CrowdStrike Authentication",
"related.user": [
"alice@company.com"
],
"service.type": "crowdstrike",
"tags": [
"forwarded"
],
"user.email": "alice@company.com",
"user.name": "alice@company.com"
}
]