Skip to content

Commit edff5d6

Browse files
brijesh-elasticbrijesh-elastic
authored
[abnormal_security] Initial release of the Abnormal Security (elastic#10653)
* Added ai_security_mailbox, audit, case and threat data stream. * Added data collection logic for all the data stream. * Added the ingest pipeline for all the data stream. * Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files. * Added dashboards and visualizations. * Added test for pipeline for all the data stream. * Added system test cases for all the data stream.
1 parent aa7118a commit edff5d6

69 files changed

Lines changed: 10872 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
# Package owners below.
99
# Please keep the list sorted.
1010
/packages/1password @elastic/security-service-integrations
11+
/packages/abnormal_security @elastic/security-service-integrations
1112
/packages/activemq @elastic/obs-infraobs-integrations
1213
/packages/airflow @elastic/obs-infraobs-integrations
1314
/packages/akamai @elastic/security-service-integrations

‎packages/abnormal_security/_dev/build/build.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
dependencies:
2+
ecs:
3+
reference: git@v8.11.0

‎packages/abnormal_security/_dev/build/docs/README.md‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# Abnormal Security
2+
3+
Abnormal Security is a behavioral AI-based email security platform that learns the behavior of every identity in a cloud email environment and analyzes the risk of every event to block even the most sophisticated attacks.
4+
5+
The Abnormal Security integration collects data for AI Security Mailbox (formerly known as Abuse Mailbox), Audit, Case, and Threat logs using REST API.
6+
7+
## Data streams
8+
9+
The Abnormal Security integration collects four types of logs:
10+
11+
**[AI Security Mailbox](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/AI%20Security%20Mailbox%20(formerly%20known%20as%20Abuse%20Mailbox))** - Get details of AI Security Mailbox.
12+
13+
**[Audit](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Audit%20Logs)** - Get details of Audit logs for Portal.
14+
15+
**[Case](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Cases)** - Get details of Abnormal Cases.
16+
17+
**[Threat](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Threats)** - Get details of Abnormal Threat Logs.
18+
19+
## Requirements
20+
21+
Elastic Agent must be installed. For more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html).
22+
23+
### Installing and managing an Elastic Agent:
24+
25+
You have a few options for installing and managing an Elastic Agent:
26+
27+
### Install a Fleet-managed Elastic Agent (recommended):
28+
29+
With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.
30+
31+
### Install Elastic Agent in standalone mode (advanced users):
32+
33+
With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.
34+
35+
### Install Elastic Agent in a containerized environment:
36+
37+
You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.
38+
39+
There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html#_minimum_requirements).
40+
41+
## Setup
42+
43+
### To collect data from the Abnormal Security Client API:
44+
45+
#### Step 1: Go to Portal
46+
* Visit the [Abnormal Security Portal](https://portal.abnormalsecurity.com/home/settings/integrations) and click on the `Abnormal REST API` setting.
47+
48+
#### Step 2: Generating the authentication token
49+
* Retrieve your authentication token. This token will be used further in the Elastic integration setup to authenticate and access different Abnormal Security Logs.
50+
51+
#### Step 3: IP allowlisting
52+
* Abnormal Security requires you to restrict API access based on source IP. So in order for the integration to work, user needs to update the IP allowlisting to include the external source IP of the endpoint running the integration via Elastic Agent.
53+
54+
### Enabling the integration in Elastic:
55+
56+
1. In Kibana go to Management > Integrations.
57+
2. In "Search for integrations" search bar, type Abnormal Security.
58+
3. Click on the "Abnormal Security" integration from the search results.
59+
4. Click on the "Add Abnormal Security" button to add the integration.
60+
5. Add all the required integration configuration parameters, including Access Token, Interval, Initial Interval and Page Size to enable data collection.
61+
6. Click on "Save and continue" to save the integration.
62+
63+
**Note**: By default, the URL is set to `https://api.abnormalplatform.com`. We have observed that Abnormal Security Base URL changes based on location so find your own base URL.
64+
65+
## Logs reference
66+
67+
### AI Security Mailbox
68+
69+
This is the `ai_security_mailbox` dataset.
70+
71+
#### Example
72+
73+
{{event "ai_security_mailbox"}}
74+
75+
{{fields "ai_security_mailbox"}}
76+
77+
### Audit
78+
79+
This is the `audit` dataset.
80+
81+
#### Example
82+
83+
{{event "audit"}}
84+
85+
{{fields "audit"}}
86+
87+
### Case
88+
89+
This is the `case` dataset.
90+
91+
#### Example
92+
93+
{{event "case"}}
94+
95+
{{fields "case"}}
96+
97+
### Threat
98+
99+
This is the `threat` dataset.
100+
101+
#### Example
102+
103+
{{event "threat"}}
104+
105+
{{fields "threat"}}

‎packages/abnormal_security/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: '2.3'
2+
services:
3+
abnormal_security:
4+
image: docker.elastic.co/observability/stream:v0.15.0
5+
hostname: abnormal_security
6+
ports:
7+
- 8090
8+
volumes:
9+
- ./files:/files:ro
10+
environment:
11+
PORT: '8090'
12+
command:
13+
- http-server
14+
- --addr=:8090
15+
- --config=/files/config.yml

0 commit comments

Comments
 (0)