[ping_one] Initial Release for the PingOne #4014

vinit-chauhan · 2022-08-17T07:08:22Z

What does this PR do?

Generated the skeleton of the PingOne integration package.
Added data stream.
Added data collection logic for the data stream.
Added the ingest pipeline for the data stream.
Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files.
Added dashboards and visualizations.
Added test for pipeline for the data stream.
Added system test cases for the data stream.

Integration release checklist

This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.

All changes

Change follows the contributing guidelines
Supported versions of the monitoring target are documented
Supported operating systems are documented (if applicable)
Integration or System tests exist
Documentation exists
Fields follow ECS and naming conventions
At least a manual test with ES / Kibana / Agent has been performed.
Required Kibana version set to: ^7.17.0 || ^8.0.0

New Package

Screenshot of the "Add Integration" page on Fleet added

Dashboards changes

Dashboards exists
Screenshots added or updated
Datastream filters added to visualizations

Log dataset changes

Pipeline tests exist (if applicable)
Generated output for at least 1 log file exists
Sample event (sample_event.json) exists

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/ping_one directory.
Run the following command to run tests.

elastic-package test

Related issues

Closes Ping Identity | PingONE #1087

Screenshots

elasticmachine · 2022-08-17T07:11:33Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

elasticmachine · 2022-08-17T07:26:44Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-10-03T12:28:04.417+0000
Duration: 15 min 7 sec

Test stats 🧪

Test	Results
Failed	0
Passed	7
Skipped	0
Total	7

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

elasticmachine · 2022-08-17T07:26:57Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`1/1`)	💚
Files	100.0% (`1/1`)	💚 2.564
Classes	100.0% (`1/1`)	💚 2.564
Methods	100.0% (`13/13`)	💚 9.946
Lines	84.95% (`254/299`)	👎 -6.579
Conditionals	100.0% (`0/0`)	💚

marc-gr · 2022-09-22T08:13:10Z

packages/ping_one/_dev/build/docs/README.md

+
+Use the PingOne integration to collect and parse data from the REST APIs or HTTP Endpoint input. Then visualize that data in Kibana.
+
+For example, you could use the data from this integration to know which action or activity is performed against a defined PingOne resource. And also tracks the actor or agent who initiated the action.


Suggested change

For example, you could use the data from this integration to know which action or activity is performed against a defined PingOne resource. And also tracks the actor or agent who initiated the action.

For example, you could use the data from this integration to know which action or activity is performed against a defined PingOne resource, and also track the actor or agent who initiated the action.

marc-gr · 2022-09-22T08:13:20Z

packages/ping_one/_dev/build/docs/README.md

+
+## Data streams
+
+The PingOne integration collect logs for one type of event: Audit.


Suggested change

The PingOne integration collect logs for one type of event: Audit.

The PingOne integration collects logs for one type of event: Audit.

marc-gr · 2022-09-22T08:16:22Z

packages/ping_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

+      field: event.original
+      target_field: json
+      ignore_failure: true
+  - script:


Could this script be changed to several set processors?

Hey, @marc-gr - Instead of using several set processors, we considered reducing the number of lines of code and combined all those processors in the script. However, let us know if using the script in such a way has any drawbacks.

I would recommend converting it to set processors as well, they are much quicker than script in general @vinit-elastic

marc-gr · 2022-09-22T08:33:39Z

packages/ping_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

+      ignore_missing: true
+  - set:
+      field: client.user.name
+      copy_from: ping_one.audit.actors.client.name


Do we need to keep duplicated fields under ECS and the custom object? I think the rename above could be just a rename to client.user.name and save one processor

We have kept two mappings for each field ( custom and ECS ) as discussed in #3837 (comment). Moreover, we are following this practice in all the connectors.

@vinit-elastic I think this could be a double edge sword in that case. Because we have on purpose removed custom fields from all our other integrations, if we would want to have something toggleable, we should have made it the same for all integrations, instead of having it on only a few.

From my point of view we should keep to the implementation we have done up until now, and simply rename the fields rather than having duplicates.

marc-gr · 2022-09-22T08:36:42Z

packages/ping_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

+      target_field: ping_one.audit.tags
+      ignore_missing: true
+  - foreach:
+      field: ping_one.audit.tags


Similar to other fields, could we just iterate over json.tags to merge it with tags and save one rename processor?

marc-gr · 2022-09-22T09:01:45Z

packages/ping_one/_dev/build/docs/README.md

+
+**Note** : Value of initial interval must be less than 2 years.
+
+### To collect data from PingOne via HTTP Endpoint, follow below steps:


Would be nice to add something explaining that this will open an endpoint to the internet, so they would need to setup proper network access and take into account any security concerns.

elasticmachine · 2022-09-26T13:04:00Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

…ql query to filter in visualization

vinit-chauhan added 2 commits August 17, 2022 12:29

Initial Release for the PingOne

e24be1d

Update changelog file

78ef985

vinit-chauhan added enhancement New feature or request Team:Security-External Integrations New Integration Issue or pull request for creating a new integration package. labels Aug 17, 2022

jamiehynds requested a review from a team September 7, 2022 08:03

epixa assigned P1llus Sep 20, 2022

marc-gr self-requested a review September 20, 2022 14:18

marc-gr reviewed Sep 22, 2022

View reviewed changes

Changes in user guide

f5a7559

vinit-chauhan added 2 commits September 29, 2022 19:05

Convert script to append processors for event.* fields and switched k…

db7117e

…ql query to filter in visualization

Add request.timeout parameter and update tag

07cd321

P1llus approved these changes Oct 4, 2022

View reviewed changes

P1llus merged commit f1c4afb into elastic:main Oct 4, 2022

andrewkroh mentioned this pull request Oct 4, 2022

[production] Promote packages from snapshot (darktrace-0.1.0, gcp-2.11.10, infoblox_bloxone_ddi-0.1.1, lastpass-0.1.0, ping_one-0.1.0, trend_micro_vision_one-0.1.0) elastic/package-storage#5786

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ping_one] Initial Release for the PingOne #4014

[ping_one] Initial Release for the PingOne #4014

vinit-chauhan commented Aug 17, 2022 •

edited

Loading

elasticmachine commented Aug 17, 2022

elasticmachine commented Aug 17, 2022 •

edited

Loading

Build stats

Test stats 🧪

elasticmachine commented Aug 17, 2022 •

edited

Loading

marc-gr Sep 22, 2022

marc-gr Sep 22, 2022

marc-gr Sep 22, 2022

vinit-chauhan Sep 26, 2022

P1llus Sep 28, 2022

marc-gr Sep 22, 2022

vinit-chauhan Sep 26, 2022

P1llus Sep 28, 2022

marc-gr Sep 22, 2022

marc-gr Sep 22, 2022

elasticmachine commented Sep 26, 2022


		Use the PingOne integration to collect and parse data from the REST APIs or HTTP Endpoint input. Then visualize that data in Kibana.

		For example, you could use the data from this integration to know which action or activity is performed against a defined PingOne resource. And also tracks the actor or agent who initiated the action.


		## Data streams

		The PingOne integration collect logs for one type of event: Audit.

	The PingOne integration collect logs for one type of event: Audit.
	The PingOne integration collects logs for one type of event: Audit.


		Note : Value of initial interval must be less than 2 years.

		### To collect data from PingOne via HTTP Endpoint, follow below steps:

[ping_one] Initial Release for the PingOne #4014

[ping_one] Initial Release for the PingOne #4014

Conversation

vinit-chauhan commented Aug 17, 2022 • edited Loading

What does this PR do?

Integration release checklist

All changes

New Package

Dashboards changes

Log dataset changes

How to test this PR locally

Related issues

Screenshots

elasticmachine commented Aug 17, 2022

elasticmachine commented Aug 17, 2022 • edited Loading

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

elasticmachine commented Aug 17, 2022 • edited Loading

🌐 Coverage report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Sep 26, 2022

🚀 Benchmarks report

vinit-chauhan commented Aug 17, 2022 •

edited

Loading

elasticmachine commented Aug 17, 2022 •

edited

Loading

elasticmachine commented Aug 17, 2022 •

edited

Loading