Skip to content

Commit 34075df

Browse files
leandrojmpleandrojmp
authored
[Prisma Cloud] Fix ingest pipeline processors with tags create_user_name_and_user_domain and convert_ip_address_to_ip that fails for some values (elastic#12752)
* fix: fix a dissect and a convert processor that were failing
1 parent 9dacfec commit 34075df

5 files changed

Lines changed: 207 additions & 3 deletions

File tree

‎packages/prisma_cloud/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.0.1"
3+
changes:
4+
- description: Fix ingest pipeline processors with tags `create_user_name_and_user_domain` and `convert_ip_address_to_ip` that fails for some values.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/12752
27
- version: "2.0.0"
38
changes:
49
- description: Map `prisma_cloud.alert.policy.description` and `prisma_cloud.alert.policy.recommendation` as text and `prisma_cloud.alert.policy.name` as multi_field text.

‎packages/prisma_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,5 @@
1-
{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
1+
{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
2+
{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"RedLock Internal IP","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
3+
{"timestamp":1693819702240,"user":"john.user@google.com","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
4+
{"timestamp":1693819702240,"user":"john.user","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
5+
{"timestamp":1693819702240,"ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}

‎packages/prisma_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,200 @@
5656
"email": "john.user@google.com",
5757
"name": "john.user"
5858
}
59+
},
60+
{
61+
"@timestamp": "2023-09-04T09:28:22.240Z",
62+
"ecs": {
63+
"version": "8.11.0"
64+
},
65+
"event": {
66+
"action": "login",
67+
"category": [
68+
"authentication"
69+
],
70+
"kind": "event",
71+
"original": "{\"timestamp\":1693819702240,\"user\":\"john.user@google.com\",\"ipAddress\":\"RedLock Internal IP\",\"actionType\":\"LOGIN\",\"resourceName\":\"john.user@google.com\",\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"resourceType\":\"Login\",\"result\":\"fail\"}",
72+
"outcome": "failure",
73+
"type": [
74+
"info"
75+
]
76+
},
77+
"prisma_cloud": {
78+
"audit": {
79+
"action": {
80+
"type": "LOGIN",
81+
"value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
82+
},
83+
"resource": {
84+
"name": "john.user@google.com",
85+
"type": "Login"
86+
},
87+
"result": "fail",
88+
"timestamp": "2023-09-04T09:28:22.240Z",
89+
"user": "john.user@google.com"
90+
}
91+
},
92+
"related": {
93+
"user": [
94+
"john.user",
95+
"john.user@google.com"
96+
]
97+
},
98+
"tags": [
99+
"preserve_original_event",
100+
"preserve_duplicate_custom_fields"
101+
],
102+
"user": {
103+
"domain": "google.com",
104+
"email": "john.user@google.com",
105+
"name": "john.user"
106+
}
107+
},
108+
{
109+
"@timestamp": "2023-09-04T09:28:22.240Z",
110+
"ecs": {
111+
"version": "8.11.0"
112+
},
113+
"event": {
114+
"action": "login",
115+
"category": [
116+
"authentication"
117+
],
118+
"kind": "event",
119+
"original": "{\"timestamp\":1693819702240,\"user\":\"john.user@google.com\",\"actionType\":\"LOGIN\",\"resourceName\":\"john.user@google.com\",\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"resourceType\":\"Login\",\"result\":\"fail\"}",
120+
"outcome": "failure",
121+
"type": [
122+
"info"
123+
]
124+
},
125+
"prisma_cloud": {
126+
"audit": {
127+
"action": {
128+
"type": "LOGIN",
129+
"value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
130+
},
131+
"resource": {
132+
"name": "john.user@google.com",
133+
"type": "Login"
134+
},
135+
"result": "fail",
136+
"timestamp": "2023-09-04T09:28:22.240Z",
137+
"user": "john.user@google.com"
138+
}
139+
},
140+
"related": {
141+
"user": [
142+
"john.user",
143+
"john.user@google.com"
144+
]
145+
},
146+
"tags": [
147+
"preserve_original_event",
148+
"preserve_duplicate_custom_fields"
149+
],
150+
"user": {
151+
"domain": "google.com",
152+
"email": "john.user@google.com",
153+
"name": "john.user"
154+
}
155+
},
156+
{
157+
"@timestamp": "2023-09-04T09:28:22.240Z",
158+
"ecs": {
159+
"version": "8.11.0"
160+
},
161+
"event": {
162+
"action": "login",
163+
"category": [
164+
"authentication"
165+
],
166+
"kind": "event",
167+
"original": "{\"timestamp\":1693819702240,\"user\":\"john.user\",\"ipAddress\":\"81.2.69.142\",\"actionType\":\"LOGIN\",\"resourceName\":\"john.user@google.com\",\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"resourceType\":\"Login\",\"result\":\"fail\"}",
168+
"outcome": "failure",
169+
"type": [
170+
"info"
171+
]
172+
},
173+
"host": {
174+
"ip": [
175+
"81.2.69.142"
176+
]
177+
},
178+
"prisma_cloud": {
179+
"audit": {
180+
"action": {
181+
"type": "LOGIN",
182+
"value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
183+
},
184+
"ip_address": "81.2.69.142",
185+
"resource": {
186+
"name": "john.user@google.com",
187+
"type": "Login"
188+
},
189+
"result": "fail",
190+
"timestamp": "2023-09-04T09:28:22.240Z",
191+
"user": "john.user"
192+
}
193+
},
194+
"related": {
195+
"ip": [
196+
"81.2.69.142"
197+
],
198+
"user": [
199+
"john.user"
200+
]
201+
},
202+
"tags": [
203+
"preserve_original_event",
204+
"preserve_duplicate_custom_fields"
205+
]
206+
},
207+
{
208+
"@timestamp": "2023-09-04T09:28:22.240Z",
209+
"ecs": {
210+
"version": "8.11.0"
211+
},
212+
"event": {
213+
"action": "login",
214+
"category": [
215+
"authentication"
216+
],
217+
"kind": "event",
218+
"original": "{\"timestamp\":1693819702240,\"ipAddress\":\"81.2.69.142\",\"actionType\":\"LOGIN\",\"resourceName\":\"john.user@google.com\",\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"resourceType\":\"Login\",\"result\":\"fail\"}",
219+
"outcome": "failure",
220+
"type": [
221+
"info"
222+
]
223+
},
224+
"host": {
225+
"ip": [
226+
"81.2.69.142"
227+
]
228+
},
229+
"prisma_cloud": {
230+
"audit": {
231+
"action": {
232+
"type": "LOGIN",
233+
"value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
234+
},
235+
"ip_address": "81.2.69.142",
236+
"resource": {
237+
"name": "john.user@google.com",
238+
"type": "Login"
239+
},
240+
"result": "fail",
241+
"timestamp": "2023-09-04T09:28:22.240Z"
242+
}
243+
},
244+
"related": {
245+
"ip": [
246+
"81.2.69.142"
247+
]
248+
},
249+
"tags": [
250+
"preserve_original_event",
251+
"preserve_duplicate_custom_fields"
252+
]
59253
}
60254
]
61255
}

‎packages/prisma_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ processors:
4040
target_field: prisma_cloud.audit.ip_address
4141
type: ip
4242
ignore_missing: true
43-
if: ctx.json?.ipAddress != ''
43+
if: ctx.json?.ipAddress != '' && ctx.json?.ipAddress != 'RedLock Internal IP'
4444
on_failure:
4545
- append:
4646
field: error.message
@@ -66,6 +66,7 @@ processors:
6666
field: user.email
6767
tag: set_prisma_cloud_audit_user
6868
copy_from: prisma_cloud.audit.user
69+
if: ctx.prisma_cloud?.audit?.user?.contains('@') == true
6970
ignore_empty_value: true
7071
- dissect:
7172
field: user.email

‎packages/prisma_cloud/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.0.3
22
name: prisma_cloud
33
title: "Palo Alto Prisma Cloud"
4-
version: "2.0.0"
4+
version: "2.0.1"
55
description: "Collect logs from Prisma Cloud with Elastic Agent."
66
type: integration
77
categories:

0 commit comments

Comments
 (0)