Skip to content

Commit 6867ba4

Browse files
taylor-swansontaylor-swanson
authored
[fortinet] Improve firewall input options (elastic#3319)
- Add TLS support and custom TCP options - Add system tests for TCP/TLS input
1 parent c01e1a2 commit 6867ba4

6 files changed

Lines changed: 125 additions & 9 deletions

File tree

‎packages/fortinet/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,42 +7,47 @@ services:
77
- ${SERVICE_LOGS_DIR}:/var/log
88
command: /bin/sh -c "cp /sample_logs/* /var/log/"
99
fortinet-clientendpoint-tcp:
10-
image: akroh/stream:v0.0.1
10+
image: docker.elastic.co/observability/stream:v0.6.2
1111
volumes:
1212
- ./sample_logs:/sample_logs:ro
1313
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/fortinet-clientendpoint.log
1414
fortinet-clientendpoint-udp:
15-
image: akroh/stream:v0.0.1
15+
image: docker.elastic.co/observability/stream:v0.6.2
1616
volumes:
1717
- ./sample_logs:/sample_logs:ro
1818
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=udp /sample_logs/fortinet-clientendpoint.log
19+
fortinet-firewall-tls:
20+
image: docker.elastic.co/observability/stream:v0.6.2
21+
volumes:
22+
- ./sample_logs:/sample_logs:ro
23+
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=tls --insecure /sample_logs/fortinet-firewall.log
1924
fortinet-firewall-tcp:
20-
image: akroh/stream:v0.0.1
25+
image: docker.elastic.co/observability/stream:v0.6.2
2126
volumes:
2227
- ./sample_logs:/sample_logs:ro
2328
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/fortinet-firewall.log
2429
fortinet-firewall-udp:
25-
image: akroh/stream:v0.0.1
30+
image: docker.elastic.co/observability/stream:v0.6.2
2631
volumes:
2732
- ./sample_logs:/sample_logs:ro
2833
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=udp /sample_logs/fortinet-firewall.log
2934
fortinet-fortimail-tcp:
30-
image: akroh/stream:v0.0.1
35+
image: docker.elastic.co/observability/stream:v0.6.2
3136
volumes:
3237
- ./sample_logs:/sample_logs:ro
3338
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/fortinet-fortimail.log
3439
fortinet-fortimail-udp:
35-
image: akroh/stream:v0.0.1
40+
image: docker.elastic.co/observability/stream:v0.6.2
3641
volumes:
3742
- ./sample_logs:/sample_logs:ro
3843
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=udp /sample_logs/fortinet-fortimail.log
3944
fortinet-fortimanager-tcp:
40-
image: akroh/stream:v0.0.1
45+
image: docker.elastic.co/observability/stream:v0.6.2
4146
volumes:
4247
- ./sample_logs:/sample_logs:ro
4348
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/fortinet-fortimanager.log
4449
fortinet-fortimanager-udp:
45-
image: akroh/stream:v0.0.1
50+
image: docker.elastic.co/observability/stream:v0.6.2
4651
volumes:
4752
- ./sample_logs:/sample_logs:ro
4853
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=udp /sample_logs/fortinet-fortimanager.log

‎packages/fortinet/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.6.0"
3+
changes:
4+
- description: Add TLS and custom options to TCP input.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/3319
27
- version: "1.5.0"
38
changes:
49
- description: Update to ECS 8.2.0 to use new email field set.

‎packages/fortinet/data_stream/firewall/_dev/test/system/test-tls-config.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
service: fortinet-firewall-tls
2+
service_notify_signal: SIGHUP
3+
input: tcp
4+
data_stream:
5+
vars:
6+
syslog_host: 0.0.0.0
7+
syslog_port: 9515
8+
preserve_original_event: true
9+
ssl: |
10+
key: |
11+
-----BEGIN PRIVATE KEY-----
12+
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDhCLvLsQAHufsN
13+
U+u1x/CequAUphfXZqLhDo2Eo/holfBS0+ey4bnzPL6lS9NFL5JkLQA2gYESqsXU
14+
/Ru8E76Az1egzMwT3TVAPLVU8NbrxBqeNiQa2m9wC37HQy4qC9OxL28LUoKtFjxS
15+
cD1sa0oikXCJN1a3BSoAf9iiZ/dxz4WVfrNhrzq2JFXjravY84n5ujkZOg45Pg70
16+
4vHOeg0rBbIoSNfjDUVZWjwC95K1BMN3msOTL9juv/EDa6BujqCxl+G1nY7JPFDL
17+
SHWis65p+1AAa5xieYDb47vyJ0SSR7lEURTXZOkkM6k5JWfgkATEmGzRxPkOloIT
18+
Xg9ag1OlAgMBAAECggEAEHfPJmzhj68wjB0kFr13AmWG2Hv/Kqg8KzQhbx+AwkaW
19+
u7j+L70NGpvLZ9VQtLNyhxoz9cksZO1SZO/Q48aeHlcOFppmJN3/U6AdtQWa9M35
20+
FLLpmX16wjxVHsfvzOvopgLOoYl8PqZt66qDFDgVyMnT7na6RdJ+7GJuvBPXq+Bc
21+
vgThvAZitHSAOhnBFYmTMlBi6AzOMMsaFlgE3Xf9v3M0pAKItPRKMhXlC3MyvA/v
22+
jgbra4Ib+0ryohggHheHB3bn3Jgv7iFKoW9OQSePVxacJ+kfr9H+No5g495URzqR
23+
mx/96WCiv3rAh3ct8Sk/C4/3zMC8fUueDJIVjhgw0QKBgQD8NufLINNkIpBrLoCS
24+
972oFEjZB2u6EusQ7X9raROqpaw26ZSu+zSHeIKCGQ93M3aRb3FpdGeOxgZ095MV
25+
8a+nlh4stOvHj2Mm5YhTBDUavTC7o9aVR3Od5eTXUpHnaJpNI/uyIcKupeK1UJnV
26+
UlBLeIwo/vJ1gsVrKMMAJkuKbwKBgQDkaWRRd0w2gUIbCTGf203BqXft0VdIiOW7
27+
+gnkeaNHAf09XljzxMcQzrB8kG63aKVGbJffphEfzxtiJ+HRQVH+7QpKRhU/GHmu
28+
+6OKkxTcxJm5zhoRFxcSi2wG4PWmUGJvc7ss1OJGcaOUxwocCepO7N/jfdDz9Uke
29+
KnA+YWOdKwKBgQDteZkYlojT0QOgF8HyH5gQyUCqMKWLJ0LzxltiPCbLV4Dml1pq
30+
w5Z7M8nWS1hXiTpLx93GSFc1hFkSCwYP9GfK6Lryp0sVtHnMZvTMDbseuSJImwRx
31+
vDwtYQfugg1lEQWwOoBEAiu3m/PxernNtNprpU57T0nlwUK3GkM5QdWAuwKBgQCZ
32+
ZF3GiANapzupxGbbH//8Cr9LqsafI7CEqMpz8WxBh4h16iJ6sq+tDeFgBe8UpOY5
33+
gTwNKg1d+0w8guQYD3HtbWr3rlEeamVtqfiOW3ArQqyqJ0tCJuuLvK3zgKf35Qv2
34+
JRaSaPT8sdxVUcXsRoxgLJu+vwPQke1koMN4YRbwuQKBgQDJiZ/WSeqa5oIqkXbn
35+
hjm7RXKaf2oE1U/bNjdSFtdEP7T4vUvvr7Hq2f/jiBLtCE7w16PJjKx9iIq2+jMl
36+
qIY43Sk9bdi5FxtYTHda0hwrbH274P+QVcVs5PXCT0TGktOleHGBlXaaPrxl9iCh
37+
8tmmxZZYa5aQxEO/lxB9xQKaiQ==
38+
-----END PRIVATE KEY-----
39+
certificate: |
40+
-----BEGIN CERTIFICATE-----
41+
MIIDazCCAlOgAwIBAgIUW5TDu1tJMY2Oa7PsL+BQSmeWqz0wDQYJKoZIhvcNAQEL
42+
BQAwRTELMAkGA1UEBhMCVVMxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
43+
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMTEwMDEwNTAwMjNaFw0yMTEw
44+
MDIwNTAwMjNaMEUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
45+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
46+
AQUAA4IBDwAwggEKAoIBAQDhCLvLsQAHufsNU+u1x/CequAUphfXZqLhDo2Eo/ho
47+
lfBS0+ey4bnzPL6lS9NFL5JkLQA2gYESqsXU/Ru8E76Az1egzMwT3TVAPLVU8Nbr
48+
xBqeNiQa2m9wC37HQy4qC9OxL28LUoKtFjxScD1sa0oikXCJN1a3BSoAf9iiZ/dx
49+
z4WVfrNhrzq2JFXjravY84n5ujkZOg45Pg704vHOeg0rBbIoSNfjDUVZWjwC95K1
50+
BMN3msOTL9juv/EDa6BujqCxl+G1nY7JPFDLSHWis65p+1AAa5xieYDb47vyJ0SS
51+
R7lEURTXZOkkM6k5JWfgkATEmGzRxPkOloITXg9ag1OlAgMBAAGjUzBRMB0GA1Ud
52+
DgQWBBRYUSKDHBBE9Q6fTeTqogicCxcXwDAfBgNVHSMEGDAWgBRYUSKDHBBE9Q6f
53+
TeTqogicCxcXwDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBc
54+
T8B+GpvPy9NQ700LsywRPY0L9IJCKiu6j3TP1tqqSPjAC/cg9ac+bFXuWOu7V+KJ
55+
s09Q/pItq9SLX6UvnfRzTxu5lCBwwGX9cL131mTIu5SmFo7Eks+sorbiIarWDMoC
56+
e+9An3GFpagW+YhOt4BdIM5lTqoeodzganDBsOUZI9aDAj2Yo5h2O7r6Wd12cb6T
57+
mz8vMfB2eG8BxU20ZMfkdERWjiyXHOSBQqeqfkV8d9370gMu5RcJNcIgnbmTRdho
58+
X3HJFiimZVaNjXATqmC/y2A1KXvJdamPLy3mGXkW2cFLoPCdK2OZFUHqiuc1bigA
59+
qEf55SihFqErRMeURPPF
60+
-----END CERTIFICATE-----

‎packages/fortinet/data_stream/firewall/agent/stream/tcp.yml.hbs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ tags:
99
{{#contains "forwarded" tags}}
1010
publisher_pipeline.disable_host: true
1111
{{/contains}}
12+
{{#if ssl}}
13+
ssl: {{ssl}}
14+
{{/if}}
1215
{{#if internal_interfaces.length}}
1316
processors:
1417
{{else}}
@@ -41,3 +44,6 @@ processors:
4144
- {{interface}}
4245
{{/each}}
4346
{{/if}}
47+
{{#if tcp_options}}
48+
{{tcp_options}}
49+
{{/if}}

‎packages/fortinet/data_stream/firewall/manifest.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,46 @@ streams:
4545
description: >
4646
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
4747
48+
- name: ssl
49+
type: yaml
50+
title: SSL Configuration
51+
description: i.e. certificate_authorities, supported_protocols, verification_mode etc.
52+
multi: false
53+
required: false
54+
show_user: false
55+
default: |
56+
#certificate_authorities:
57+
# - |
58+
# -----BEGIN CERTIFICATE-----
59+
# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF
60+
# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2
61+
# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB
62+
# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n
63+
# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl
64+
# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t
65+
# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP
66+
# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41
67+
# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O
68+
# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux
69+
# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D
70+
# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw
71+
# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA
72+
# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu
73+
# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0
74+
# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk
75+
# sxSmbIUfc2SGJGCJD4I=
76+
# -----END CERTIFICATE-----
77+
- name: tcp_options
78+
type: yaml
79+
title: Custom TCP Options
80+
multi: false
81+
required: false
82+
show_user: false
83+
default: |
84+
#max_connections: 1
85+
#framing: delimitier
86+
#line_delimiter: "\n"
87+
description: Specify custom configuration options for the TCP input.
4888
template_path: tcp.yml.hbs
4989
title: Fortinet firewall logs (tcp)
5090
description: Collect Fortinet firewall logs using tcp input

‎packages/fortinet/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: fortinet
22
title: Fortinet Logs
3-
version: 1.5.0
3+
version: 1.6.0
44
release: ga
55
description: Collect logs from Fortinet instances with Elastic Agent.
66
type: integration

0 commit comments

Comments
 (0)