Admin By Request EPM Connector #12402
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
andrewkroh
added
the
New Integration
andrewkroh
added
Integration:1password
qcorporation
force-pushed
the
main
branch
2 times, most recently
from
eda4138 to
f728ca7
Compare
ravikumar5555
force-pushed
the
adminbyrequest
branch
from
6087499 to
f6847f1
Compare
ravikumar5555
changed the title
There was a problem hiding this comment.
We should remove this file.
HeroicHorizon
requested changes
Feb 12, 2025
| resource.timeout: {{http_client_timeout}} | ||
| {{/if}} | ||
| resource.ssl.renegotiation: "freely" | ||
| resource.ssl.verification_mode: "certificate" |
There was a problem hiding this comment.
resource.ssl.renegotiation: "freely"
resource.ssl.verification_mode: "certificate"
remove this
| {{#if http_client_timeout}} | ||
| resource.timeout: {{http_client_timeout}} | ||
| {{/if}} | ||
| resource.ssl.renegotiation: freely |
There was a problem hiding this comment.
remove this: resource.ssl.renegotiation: freely
| description: "Admin By Request EPM is a solution for managing and monitoring privileged access to Windows and Mac computers. It enables real-time monitoring of privileged account access, session recordings, and password checkout patterns to help security teams maintain compliance and quickly identify potential privilege abuse." | ||
| type: integration | ||
| categories: | ||
| - custom |
There was a problem hiding this comment.
Suggested change
| - custom | |
| - security |
| @@ -0,0 +1,5 @@ | |||
| - version: "0.0.1" | |||
There was a problem hiding this comment.
Suggested change
| - version: "0.0.1" | |
| - version: "0.1.0" |
| format_version: 3.3.0 | ||
| name: admin_by_request_epm | ||
| title: Admin By Request EPM | ||
| version: 0.0.1 |
There was a problem hiding this comment.
Suggested change
| version: 0.0.1 | |
| version: 0.1.0 |
.github/CODEOWNERS
Outdated
| @@ -10,6 +10,7 @@ | |||
| /packages/1password @elastic/security-service-integrations | |||
| /packages/abnormal_security @elastic/security-service-integrations | |||
| /packages/activemq @elastic/obs-infraobs-integrations | |||
| /packages/adminbyrequest @elastic/security-service-integrations | |||
There was a problem hiding this comment.
Suggested change
| /packages/adminbyrequest @elastic/security-service-integrations | |
| /packages/admin_by_request_epm @elastic/security-service-integrations |
| - fingerprint: | ||
| fields: | ||
| - admin_by_request_epm.auditlog.id | ||
| target_field: "_id" |
There was a problem hiding this comment.
so for fingerprint we can have either ignore_missing: true or have a more robust on_failure condition something like:
- fingerprint:
fields:
- admin_by_request_epm.auditlog.id
target_field: "_id"
on_failure:
- append:
field: error.message
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'```
| - fingerprint: | ||
| fields: | ||
| - admin_by_request_epm.events.id | ||
| target_field: "_id" |
There was a problem hiding this comment.
so for fingerprint we can have either ignore_missing: true or have a more robust on_failure condition something like:
- fingerprint:
fields:
- admin_by_request_epm.events.id
tag: fingerprinting
target_field: "_id"
on_failure:
- append:
field: error.message
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
|
|
||
| - **`auditlog`**: Provides audit data that includes elevation requests, approvals, application installations, and scan results. | ||
| - [Auditlog](https://www.adminbyrequest.com/en/docs/auditlog-api) are records generated when user takes action such as installing a software, running an application with admin privileges, requesting for admin session, approval or denial of requests and scan results. | ||
| - This data stream leverages the Admin By Request EPM API `/auditlog/delta` endpoint to retrieve data. |
There was a problem hiding this comment.
Add to Admin By Request EPM API /auditlog/delta
link: https://www.adminbyrequest.com/en/docs/auditlog-api#:~:text=throttle%20your%20account-,Delta%20Data,-To%20avoid%20having
|
|
||
| - **`events`**: Provides system security events and administrative changes, including group modifications, policy changes and security violations. This allows tracking of administrative activities and security-critical events. Some events have corresponding audit log entries. | ||
| - [Events](https://www.adminbyrequest.com/en/docs/events-api) are records that are generated on various actions done by users and administrators. These include group modifications, policy changes, security violations, and other administrative activities. | ||
| - This data stream leverages the Admin By Request EPM API `/events` endpoint to retrieve data. |
There was a problem hiding this comment.
Add link to Admin By Request EPM API /events endpoint
link: https://www.adminbyrequest.com/en/docs/events-api
🚀 Benchmarks reportTo see the full report comment with |
|
💔 Build Failed
Failed CI StepsHistory
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
This Pull Request introduces the initial release of a new integration for Admin By Request EPM. The integration captures events, specifically
/auditlog/eventsIt also allows to use real-time data using CEL agent by starting a listener on elastic side.
Key features include:
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
packages/admin_by_request_epmfolder.How to test this PR locally
Manual testing
Running elastic stack is required.
admin_by_request_epmpackage locally.README.md)event.dataset :"admin_by_request_epm.auditlog"for auditlog data stream and filter byevent.dataset :"admin_by_request_epm.events"for events data streamdata_stream/auditlog/_dev/test/pipeline/anddata_stream/events/_dev/test/pipeline/gives a few examples of requests can be used to test the endpoint.Automated testing
elastic-package.integrations/packages/admin_by_request_epmdirectory.cd packages/admin_by_request_epmRelated issues
Screenshots