Skip to content

Commit a9fb00d

Browse files
taylor-swansontaylor-swanson
authored
[cisco_ftd] Add TCP input with TLS support (elastic#3313)
- Add TCP input, with TLS and custom options support - Add system test for TCP input
1 parent ba53914 commit a9fb00d

6 files changed

Lines changed: 130 additions & 2 deletions

File tree

‎packages/cisco_ftd/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@ services:
66
- ./sample_logs:/sample_logs:ro
77
- ${SERVICE_LOGS_DIR}:/var/log
88
command: /bin/sh -c "cp /sample_logs/* /var/log/"
9+
cisco-ftd-tcp:
10+
image: docker.elastic.co/observability/stream:v0.6.2
11+
volumes:
12+
- ./sample_logs:/sample_logs:ro
13+
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/cisco-ftd.log
914
cisco-ftd-udp:
10-
image: docker.elastic.co/observability/stream:v0.5.0
15+
image: docker.elastic.co/observability/stream:v0.6.2
1116
volumes:
1217
- ./sample_logs:/sample_logs:ro
1318
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=udp /sample_logs/cisco-ftd.log

‎packages/cisco_ftd/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.2.0"
3+
changes:
4+
- description: Add TCP input with TLS support
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/3313
27
- version: "2.1.1"
38
changes:
49
- description: Added link to Cisco's FTD documentation in readme

‎packages/cisco_ftd/data_stream/log/_dev/test/system/test-tcp-config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
service: cisco-ftd-tcp
2+
service_notify_signal: SIGHUP
3+
input: tcp
4+
data_stream:
5+
vars:
6+
tcp_host: 0.0.0.0
7+
tcp_port: 9514
8+
preserve_original_event: true

‎packages/cisco_ftd/data_stream/log/agent/stream/tcp.yml.hbs‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
host: "{{tcp_host}}:{{tcp_port}}"
2+
tags:
3+
{{#if preserve_original_event}}
4+
- preserve_original_event
5+
{{/if}}
6+
{{#each tags as |tag i|}}
7+
- {{tag}}
8+
{{/each}}
9+
{{#contains "forwarded" tags}}
10+
publisher_pipeline.disable_host: true
11+
{{/contains}}
12+
{{#if ssl}}
13+
ssl: {{ssl}}
14+
{{/if}}
15+
processors:
16+
- add_locale: ~
17+
{{#if processors}}
18+
{{processors}}
19+
{{/if}}
20+
{{#if tcp_options}}
21+
{{tcp_options}}
22+
{{/if}}

‎packages/cisco_ftd/data_stream/log/manifest.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,91 @@ streams:
4646
description: >
4747
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
4848
49+
- input: tcp
50+
title: Cisco FTD logs
51+
description: Collect Cisco FTD logs
52+
template_path: tcp.yml.hbs
53+
vars:
54+
- name: tags
55+
type: text
56+
title: Tags
57+
multi: true
58+
required: true
59+
show_user: false
60+
default:
61+
- cisco-ftd
62+
- forwarded
63+
- name: tcp_host
64+
type: text
65+
title: TCP host to listen on
66+
multi: false
67+
required: true
68+
show_user: true
69+
default: localhost
70+
- name: tcp_port
71+
type: integer
72+
title: TCP Port to listen on
73+
multi: false
74+
required: true
75+
show_user: true
76+
default: 9003
77+
- name: preserve_original_event
78+
required: true
79+
show_user: true
80+
title: Preserve original event
81+
description: Preserves a raw copy of the original event, added to the field `event.original`
82+
type: bool
83+
multi: false
84+
default: false
85+
- name: processors
86+
type: yaml
87+
title: Processors
88+
multi: false
89+
required: false
90+
show_user: false
91+
description: >
92+
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
93+
94+
- name: ssl
95+
type: yaml
96+
title: SSL Configuration
97+
description: i.e. certificate_authorities, supported_protocols, verification_mode etc.
98+
multi: false
99+
required: false
100+
show_user: false
101+
default: |
102+
#certificate_authorities:
103+
# - |
104+
# -----BEGIN CERTIFICATE-----
105+
# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF
106+
# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2
107+
# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB
108+
# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n
109+
# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl
110+
# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t
111+
# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP
112+
# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41
113+
# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O
114+
# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux
115+
# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D
116+
# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw
117+
# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA
118+
# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu
119+
# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0
120+
# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk
121+
# sxSmbIUfc2SGJGCJD4I=
122+
# -----END CERTIFICATE-----
123+
- name: tcp_options
124+
type: yaml
125+
title: Custom TCP Options
126+
multi: false
127+
required: false
128+
show_user: false
129+
default: |
130+
#max_connections: 1
131+
#framing: delimitier
132+
#line_delimiter: "\n"
133+
description: Specify custom configuration options for the TCP input.
49134
- input: logfile
50135
enabled: false
51136
title: Cisco FTD logs

‎packages/cisco_ftd/manifest.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 1.0.0
22
name: cisco_ftd
33
title: Cisco FTD
4-
version: 2.1.1
4+
version: 2.2.0
55
license: basic
66
description: Collect logs from Cisco FTD with Elastic Agent.
77
type: integration
@@ -21,6 +21,9 @@ policy_templates:
2121
title: Cisco FTD logs
2222
description: Collect logs from Cisco FTD instances
2323
inputs:
24+
- type: tcp
25+
title: Collect logs from Cisco FTD via TCP
26+
description: Collecting logs from Cisco FTD via TCP
2427
- type: udp
2528
title: Collect logs from Cisco FTD via UDP
2629
description: Collecting logs from Cisco FTD via UDP

0 commit comments

Comments
 (0)