Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Prisma Cloud] Fix ingest pipeline processors with tags create_user_name_and_user_domain and convert_ip_address_to_ip that fails for some values #12752

Merged
merged 2 commits into from
Feb 13, 2025
+207 −3
Merged

[Prisma Cloud] Fix ingest pipeline processors with tags create_user_name_and_user_domain and convert_ip_address_to_ip that fails for some values #12752

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c04601a
fix: fix a dissect and a convert processor that were failing
leandrojmp Feb 12, 2025
0d59e69
add tests + adjust conditionals
leandrojmp Feb 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/prisma_cloud/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.0.1"
changes:
- description: Fix ingest pipeline processors with tags `create_user_name_and_user_domain` and `convert_ip_address_to_ip` that fails for some values.
type: bugfix
link: https://github.com/elastic/integrations/pull/12752
- version: "2.0.0"
changes:
- description: Map `prisma_cloud.alert.policy.description` and `prisma_cloud.alert.policy.recommendation` as text and `prisma_cloud.alert.policy.name` as multi_field text.
Expand Down
6 changes: 5 additions & 1 deletion packages/prisma_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,5 @@
{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"RedLock Internal IP","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
{"timestamp":1693819702240,"user":"john.user@google.com","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
{"timestamp":1693819702240,"user":"john.user","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
{"timestamp":1693819702240,"ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
194 changes: 194 additions & 0 deletions packages/prisma_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,200 @@
"email": "john.user@google.com",
"name": "john.user"
}
},
{
"@timestamp": "2023-09-04T09:28:22.240Z",
"ecs": {
"version": "8.11.0"
},
"event": {
"action": "login",
"category": [
"authentication"
],
"kind": "event",
"original": "{\"timestamp\":1693819702240,\"user\":\"john.user@google.com\",\"ipAddress\":\"RedLock Internal IP\",\"actionType\":\"LOGIN\",\"resourceName\":\"john.user@google.com\",\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"resourceType\":\"Login\",\"result\":\"fail\"}",
"outcome": "failure",
"type": [
"info"
]
},
"prisma_cloud": {
"audit": {
"action": {
"type": "LOGIN",
"value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
},
"resource": {
"name": "john.user@google.com",
"type": "Login"
},
"result": "fail",
"timestamp": "2023-09-04T09:28:22.240Z",
"user": "john.user@google.com"
}
},
"related": {
"user": [
"john.user",
"john.user@google.com"
]
},
"tags": [
"preserve_original_event",
"preserve_duplicate_custom_fields"
],
"user": {
"domain": "google.com",
"email": "john.user@google.com",
"name": "john.user"
}
},
{
"@timestamp": "2023-09-04T09:28:22.240Z",
"ecs": {
"version": "8.11.0"
},
"event": {
"action": "login",
"category": [
"authentication"
],
"kind": "event",
"original": "{\"timestamp\":1693819702240,\"user\":\"john.user@google.com\",\"actionType\":\"LOGIN\",\"resourceName\":\"john.user@google.com\",\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"resourceType\":\"Login\",\"result\":\"fail\"}",
"outcome": "failure",
"type": [
"info"
]
},
"prisma_cloud": {
"audit": {
"action": {
"type": "LOGIN",
"value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
},
"resource": {
"name": "john.user@google.com",
"type": "Login"
},
"result": "fail",
"timestamp": "2023-09-04T09:28:22.240Z",
"user": "john.user@google.com"
}
},
"related": {
"user": [
"john.user",
"john.user@google.com"
]
},
"tags": [
"preserve_original_event",
"preserve_duplicate_custom_fields"
],
"user": {
"domain": "google.com",
"email": "john.user@google.com",
"name": "john.user"
}
},
{
"@timestamp": "2023-09-04T09:28:22.240Z",
"ecs": {
"version": "8.11.0"
},
"event": {
"action": "login",
"category": [
"authentication"
],
"kind": "event",
"original": "{\"timestamp\":1693819702240,\"user\":\"john.user\",\"ipAddress\":\"81.2.69.142\",\"actionType\":\"LOGIN\",\"resourceName\":\"john.user@google.com\",\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"resourceType\":\"Login\",\"result\":\"fail\"}",
"outcome": "failure",
"type": [
"info"
]
},
"host": {
"ip": [
"81.2.69.142"
]
},
"prisma_cloud": {
"audit": {
"action": {
"type": "LOGIN",
"value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
},
"ip_address": "81.2.69.142",
"resource": {
"name": "john.user@google.com",
"type": "Login"
},
"result": "fail",
"timestamp": "2023-09-04T09:28:22.240Z",
"user": "john.user"
}
},
"related": {
"ip": [
"81.2.69.142"
],
"user": [
"john.user"
]
},
"tags": [
"preserve_original_event",
"preserve_duplicate_custom_fields"
]
},
{
"@timestamp": "2023-09-04T09:28:22.240Z",
"ecs": {
"version": "8.11.0"
},
"event": {
"action": "login",
"category": [
"authentication"
],
"kind": "event",
"original": "{\"timestamp\":1693819702240,\"ipAddress\":\"81.2.69.142\",\"actionType\":\"LOGIN\",\"resourceName\":\"john.user@google.com\",\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"resourceType\":\"Login\",\"result\":\"fail\"}",
"outcome": "failure",
"type": [
"info"
]
},
"host": {
"ip": [
"81.2.69.142"
]
},
"prisma_cloud": {
"audit": {
"action": {
"type": "LOGIN",
"value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
},
"ip_address": "81.2.69.142",
"resource": {
"name": "john.user@google.com",
"type": "Login"
},
"result": "fail",
"timestamp": "2023-09-04T09:28:22.240Z"
}
},
"related": {
"ip": [
"81.2.69.142"
]
},
"tags": [
"preserve_original_event",
"preserve_duplicate_custom_fields"
]
}
]
}
3 changes: 2 additions & 1 deletion packages/prisma_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ processors:
target_field: prisma_cloud.audit.ip_address
type: ip
ignore_missing: true
if: ctx.json?.ipAddress != ''
if: ctx.json?.ipAddress != '' && ctx.json?.ipAddress != 'RedLock Internal IP'
on_failure:
- append:
field: error.message
Expand All @@ -66,6 +66,7 @@ processors:
field: user.email
tag: set_prisma_cloud_audit_user
copy_from: prisma_cloud.audit.user
if: ctx.prisma_cloud?.audit?.user?.contains('@') == true
ignore_empty_value: true
- dissect:
field: user.email
Expand Down
2 changes: 1 addition & 1 deletion packages/prisma_cloud/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 3.0.3
name: prisma_cloud
title: "Palo Alto Prisma Cloud"
version: "2.0.0"
version: "2.0.1"
description: "Collect logs from Prisma Cloud with Elastic Agent."
type: integration
categories:
Expand Down