Skip to content

Commit 8f0d74c

Browse files
andrewkrohandrewkroh
authored
[sophos.utm] Format {source,destination}.mac per ECS (elastic#3370)
* sophos.utm - Format {source,destination}.mac per ECS * Add changelog
1 parent 08a4339 commit 8f0d74c

6 files changed

Lines changed: 257 additions & 2 deletions

File tree

‎packages/sophos/_dev/deploy/docker/sample_logs/sophos-utm-generated.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,3 +98,5 @@
9898
2019:11:15-17:19:22 emvel4391.localhost sshd: Did not receive identification string from quelaud
9999
2019:11:30-00:21:57 confd-sync[5454]: id=smodite severity=high sys=utpersp sub=rnatu name=ico
100100
2019:12:14-07:24:31 untinc5531.www5.test sshd: error: Could not get shadow information for NOUSER
101+
2019:04:08-11:21:55 galaxy ulogd[5009]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="3000000014" initf="eth0" outitf="eth3" srcmac="00:50:56:c0:00:01" dstmac="00:0c:29:93:cc:85" srcip="192.168.168.1" dstip="172.30.30.1" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="57051" dstport="51130" tcpflags="SYN"
102+
2019:04:08-11:22:05 gemini ulogd[8882]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62003" initf="eth0" srcmac="00:0c:29:93:cc:a3" dstmac="00:0c:29:69:57:8b" srcip="192.168.168.1" dstip="172.30.30.1" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="57096" dstport="51130" tcpflags="SYN"

‎packages/sophos/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.2.1"
3+
changes:
4+
- description: Format source.mac and destination.mac as per ECS for the UTM data stream.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/3370
27
- version: "2.2.0"
38
changes:
49
- description: Improve inputs for Sophos XG pipeline.

‎packages/sophos/data_stream/utm/_dev/test/pipeline/test-packet-filter.json‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
{
2+
"events": [
3+
{
4+
"@timestamp": "2019-04-08T11:21:55.000Z",
5+
"agent": {
6+
"ephemeral_id": "e311f248-bcfe-40fa-a92c-75047bac1b66",
7+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
8+
"name": "docker-fleet-agent",
9+
"type": "filebeat",
10+
"version": "8.1.3"
11+
},
12+
"data_stream": {
13+
"dataset": "sophos.utm",
14+
"namespace": "ep",
15+
"type": "logs"
16+
},
17+
"destination": {
18+
"ip": "172.30.30.1",
19+
"mac": "00:0c:29:93:cc:85",
20+
"port": 51130
21+
},
22+
"ecs": {
23+
"version": "8.0.0"
24+
},
25+
"elastic_agent": {
26+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
27+
"snapshot": false,
28+
"version": "8.1.3"
29+
},
30+
"event": {
31+
"code": "ulogd",
32+
"dataset": "sophos.utm",
33+
"original": "2019:04:08-11:21:55 galaxy ulogd[5009]: id=\"2002\" severity=\"info\" sys=\"SecureNet\" sub=\"packetfilter\" name=\"Packet accepted\" action=\"accept\" fwrule=\"3000000014\" initf=\"eth0\" outitf=\"eth3\" srcmac=\"00:50:56:c0:00:01\" dstmac=\"00:0c:29:93:cc:85\" srcip=\"192.168.168.1\" dstip=\"172.30.30.1\" proto=\"6\" length=\"52\" tos=\"0x00\" prec=\"0x00\" ttl=\"127\" srcport=\"57051\" dstport=\"51130\" tcpflags=\"SYN\"",
34+
"timezone": "+00:00"
35+
},
36+
"host": {
37+
"name": "galaxy"
38+
},
39+
"input": {
40+
"type": "log"
41+
},
42+
"log": {
43+
"file": {
44+
"path": "/tmp/service_logs/sophos-utm-generated.log"
45+
},
46+
"level": "info",
47+
"offset": 24605
48+
},
49+
"message": "\"Packet",
50+
"observer": {
51+
"egress": {
52+
"interface": {
53+
"name": "eth3"
54+
}
55+
},
56+
"ingress": {
57+
"interface": {
58+
"name": "eth0"
59+
}
60+
},
61+
"product": "UTM",
62+
"type": "Firewall",
63+
"vendor": "Sophos"
64+
},
65+
"process": {
66+
"pid": 5009
67+
},
68+
"related": {
69+
"ip": [
70+
"172.30.30.1",
71+
"192.168.168.1"
72+
]
73+
},
74+
"rsa": {
75+
"internal": {
76+
"event_desc": "\"Packet",
77+
"messageid": "ulogd"
78+
},
79+
"investigations": {
80+
"ec_activity": "Scan",
81+
"ec_subject": "NetworkComm",
82+
"ec_theme": "TEV",
83+
"event_cat": 1901000000,
84+
"event_cat_name": "Other.Default"
85+
},
86+
"misc": {
87+
"policy_id": "3000000014",
88+
"rule": "2002",
89+
"severity": "info",
90+
"vsys": "SecureNet"
91+
},
92+
"network": {
93+
"alias_host": [
94+
"galaxy"
95+
],
96+
"dinterface": "eth3",
97+
"network_service": "packetfilter",
98+
"sinterface": "eth0"
99+
},
100+
"time": {
101+
"event_time": "2019-04-08T11:21:55.000Z"
102+
}
103+
},
104+
"source": {
105+
"ip": "192.168.168.1",
106+
"mac": "00:50:56:c0:00:01",
107+
"port": 57051
108+
},
109+
"tags": [
110+
"sophos-utm",
111+
"forwarded"
112+
]
113+
}
114+
]
115+
}

‎packages/sophos/data_stream/utm/_dev/test/pipeline/test-packet-filter.json-expected.json‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2019-04-08T11:21:55.000Z",
5+
"agent": {
6+
"ephemeral_id": "e311f248-bcfe-40fa-a92c-75047bac1b66",
7+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
8+
"name": "docker-fleet-agent",
9+
"type": "filebeat",
10+
"version": "8.1.3"
11+
},
12+
"data_stream": {
13+
"dataset": "sophos.utm",
14+
"namespace": "ep",
15+
"type": "logs"
16+
},
17+
"destination": {
18+
"ip": "172.30.30.1",
19+
"mac": "00-0C-29-93-CC-85",
20+
"port": 51130
21+
},
22+
"ecs": {
23+
"version": "8.2.0"
24+
},
25+
"elastic_agent": {
26+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
27+
"snapshot": false,
28+
"version": "8.1.3"
29+
},
30+
"event": {
31+
"code": "ulogd",
32+
"dataset": "sophos.utm",
33+
"original": "2019:04:08-11:21:55 galaxy ulogd[5009]: id=\"2002\" severity=\"info\" sys=\"SecureNet\" sub=\"packetfilter\" name=\"Packet accepted\" action=\"accept\" fwrule=\"3000000014\" initf=\"eth0\" outitf=\"eth3\" srcmac=\"00:50:56:c0:00:01\" dstmac=\"00:0c:29:93:cc:85\" srcip=\"192.168.168.1\" dstip=\"172.30.30.1\" proto=\"6\" length=\"52\" tos=\"0x00\" prec=\"0x00\" ttl=\"127\" srcport=\"57051\" dstport=\"51130\" tcpflags=\"SYN\"",
34+
"timezone": "+00:00"
35+
},
36+
"host": {
37+
"name": "galaxy"
38+
},
39+
"input": {
40+
"type": "log"
41+
},
42+
"log": {
43+
"file": {
44+
"path": "/tmp/service_logs/sophos-utm-generated.log"
45+
},
46+
"level": "info",
47+
"offset": 24605
48+
},
49+
"message": "\"Packet",
50+
"observer": {
51+
"egress": {
52+
"interface": {
53+
"name": "eth3"
54+
}
55+
},
56+
"ingress": {
57+
"interface": {
58+
"name": "eth0"
59+
}
60+
},
61+
"product": "UTM",
62+
"type": "Firewall",
63+
"vendor": "Sophos"
64+
},
65+
"process": {
66+
"pid": 5009
67+
},
68+
"related": {
69+
"hosts": [
70+
"galaxy"
71+
],
72+
"ip": [
73+
"172.30.30.1",
74+
"192.168.168.1"
75+
]
76+
},
77+
"rsa": {
78+
"internal": {
79+
"event_desc": "\"Packet",
80+
"messageid": "ulogd"
81+
},
82+
"investigations": {
83+
"ec_activity": "Scan",
84+
"ec_subject": "NetworkComm",
85+
"ec_theme": "TEV",
86+
"event_cat": 1901000000,
87+
"event_cat_name": "Other.Default"
88+
},
89+
"misc": {
90+
"policy_id": "3000000014",
91+
"rule": "2002",
92+
"severity": "info",
93+
"vsys": "SecureNet"
94+
},
95+
"network": {
96+
"alias_host": [
97+
"galaxy"
98+
],
99+
"dinterface": "eth3",
100+
"network_service": "packetfilter",
101+
"sinterface": "eth0"
102+
},
103+
"time": {
104+
"event_time": "2019-04-08T11:21:55.000Z"
105+
}
106+
},
107+
"source": {
108+
"ip": "192.168.168.1",
109+
"mac": "00-50-56-C0-00-01",
110+
"port": 57051
111+
},
112+
"tags": [
113+
"preserve_original_event"
114+
]
115+
}
116+
]
117+
}

‎packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,26 @@
11
---
2-
description: Pipeline for Astaro Security Gateway
2+
description: Pipeline for Sophos UTM (formerly Astaro Security Gateway).
33

44
processors:
55
- set:
66
field: ecs.version
77
value: '8.2.0'
8+
- gsub:
9+
field: destination.mac
10+
ignore_missing: true
11+
pattern: '[:]'
12+
replacement: '-'
13+
- gsub:
14+
field: source.mac
15+
ignore_missing: true
16+
pattern: '[:]'
17+
replacement: '-'
18+
- uppercase:
19+
field: destination.mac
20+
ignore_missing: true
21+
- uppercase:
22+
field: source.mac
23+
ignore_missing: true
824
# User agent
925
- user_agent:
1026
field: user_agent.original

‎packages/sophos/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 1.0.0
22
name: sophos
33
title: Sophos Logs
4-
version: 2.2.0
4+
version: "2.2.1"
55
description: Collect and parse logs from Sophos Products with Elastic Agent.
66
categories: ["security"]
77
release: ga

0 commit comments

Comments
 (0)