From 212d59952135bb581464dcf4fdcac59657892b7c Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Tue, 9 Feb 2021 16:26:49 +0100 Subject: [PATCH] Upgrade juniper/srx to ecs 1.8.0 --- CHANGELOG.next.asciidoc | 1 + .../module/juniper/srx/config/srx.yml | 2 +- .../module/juniper/srx/ingest/pipeline.yml | 20 ++++++ .../juniper/srx/test/atp.log-expected.json | 6 ++ .../juniper/srx/test/flow.log-expected.json | 62 +++++++------------ .../juniper/srx/test/idp.log-expected.json | 6 ++ .../juniper/srx/test/utm.log-expected.json | 15 +++++ 7 files changed, 71 insertions(+), 41 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 7331baaebbce..b11f465ac00f 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -836,6 +836,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Upgrade CEF module to ECS 1.8.0. {pull}23832[23832] - Upgrade fortinet/firewall to ECS 1.8 {issue}23118[23118] {pull}23902[23902] - Upgrade Zeek to ECS 1.8.0. {issue}23118[23118] {pull}23847[23847] +- Upgrade juniper/srx to ecs 1.8.0. {issue}23118[23118] {pull}23936[23936] *Heartbeat* diff --git a/x-pack/filebeat/module/juniper/srx/config/srx.yml b/x-pack/filebeat/module/juniper/srx/config/srx.yml index 6af16945317c..021eca1c9645 100644 --- a/x-pack/filebeat/module/juniper/srx/config/srx.yml +++ b/x-pack/filebeat/module/juniper/srx/config/srx.yml @@ -28,4 +28,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.8.0 diff --git a/x-pack/filebeat/module/juniper/srx/ingest/pipeline.yml b/x-pack/filebeat/module/juniper/srx/ingest/pipeline.yml index 9fb9057b8fa8..a7d4b22ee7ed 100644 --- a/x-pack/filebeat/module/juniper/srx/ingest/pipeline.yml +++ b/x-pack/filebeat/module/juniper/srx/ingest/pipeline.yml @@ -238,37 +238,57 @@ processors: field: related.ip value: '{{source.ip}}' ignore_failure: true + allow_duplicates: false - append: if: 'ctx.destination?.ip != null' field: related.ip value: '{{destination.ip}}' ignore_failure: true + allow_duplicates: false - append: if: 'ctx.source?.nat?.ip != null' field: related.ip value: '{{source.nat.ip}}' ignore_failure: true + allow_duplicates: false - append: if: 'ctx?.destination?.nat?.ip != null' field: related.ip value: '{{destination.nat.ip}}' ignore_failure: true + allow_duplicates: false - append: if: 'ctx.url?.domain != null' field: related.hosts value: '{{url.domain}}' ignore_failure: true + allow_duplicates: false - append: if: 'ctx.source?.domain != null' field: related.hosts value: '{{source.domain}}' ignore_failure: true + allow_duplicates: false - append: if: 'ctx.destination?.domain != null' field: related.hosts value: '{{destination.domain}}' ignore_failure: true + allow_duplicates: false + +- append: + if: 'ctx?.source?.user?.name != null' + field: related.user + value: '{{source.user.name}}' + ignore_failure: true + allow_duplicates: false +- append: + if: 'ctx?.destination?.user?.name != null' + field: related.user + value: '{{destination.user.name}}' + ignore_failure: true + allow_duplicates: false on_failure: - set: diff --git a/x-pack/filebeat/module/juniper/srx/test/atp.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/atp.log-expected.json index 69639938252b..9227f428e4a1 100644 --- a/x-pack/filebeat/module/juniper/srx/test/atp.log-expected.json +++ b/x-pack/filebeat/module/juniper/srx/test/atp.log-expected.json @@ -58,6 +58,9 @@ "10.10.10.1", "187.19.188.200" ], + "related.user": [ + "user1" + ], "server.ip": "187.19.188.200", "server.port": 80, "service.type": "juniper", @@ -110,6 +113,9 @@ "related.ip": [ "192.0.2.0" ], + "related.user": [ + "admin" + ], "service.type": "juniper", "source.domain": "host.example.com", "source.ip": "192.0.2.0", diff --git a/x-pack/filebeat/module/juniper/srx/test/flow.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/flow.log-expected.json index 9eb70c83a645..622200c634ae 100644 --- a/x-pack/filebeat/module/juniper/srx/test/flow.log-expected.json +++ b/x-pack/filebeat/module/juniper/srx/test/flow.log-expected.json @@ -44,8 +44,6 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "10.0.0.1", - "10.128.0.1", "10.0.0.1", "10.128.0.1" ], @@ -245,8 +243,6 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "1.2.3.4", - "5.6.7.8", "1.2.3.4", "5.6.7.8" ], @@ -323,8 +319,6 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "50.0.0.100", - "30.0.0.100", "50.0.0.100", "30.0.0.100" ], @@ -396,7 +390,6 @@ "related.ip": [ "192.0.2.1", "198.51.100.12", - "192.0.2.1", "18.51.100.12" ], "rule.name": "policy1", @@ -472,7 +465,6 @@ "related.ip": [ "192.0.2.1", "198.51.100.12", - "192.0.2.1", "18.51.100.12" ], "rule.name": "policy1", @@ -563,8 +555,7 @@ "related.ip": [ "10.3.255.203", "8.23.224.110", - "10.3.136.49", - "8.23.224.110" + "10.3.136.49" ], "rule.name": "permit_all", "server.bytes": 535, @@ -636,8 +627,6 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "192.168.2.164", - "172.16.1.19", "192.168.2.164", "172.16.1.19" ], @@ -722,8 +711,7 @@ "related.ip": [ "100.73.10.92", "58.68.126.198", - "58.78.140.131", - "58.68.126.198" + "58.78.140.131" ], "rule.name": "NAT", "server.bytes": 136, @@ -816,8 +804,7 @@ "related.ip": [ "192.168.255.2", "8.8.8.8", - "192.168.0.47", - "8.8.8.8" + "192.168.0.47" ], "rule.name": "trust-to-untrust-001", "server.bytes": 116, @@ -966,8 +953,7 @@ "related.ip": [ "192.168.224.30", "207.17.137.56", - "173.167.224.7", - "207.17.137.56" + "173.167.224.7" ], "rule.name": "General-Outbound", "server.ip": "207.17.137.56", @@ -1053,8 +1039,7 @@ "related.ip": [ "192.168.224.30", "207.17.137.56", - "173.167.224.7", - "207.17.137.56" + "173.167.224.7" ], "rule.name": "General-Outbound", "server.bytes": 0, @@ -1146,8 +1131,7 @@ "related.ip": [ "192.168.224.30", "207.17.137.56", - "173.167.224.7", - "207.17.137.56" + "173.167.224.7" ], "rule.name": "General-Outbound", "server.bytes": 104, @@ -1240,11 +1224,12 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "4.0.0.1", - "5.0.0.1", "4.0.0.1", "5.0.0.1" ], + "related.user": [ + "user1" + ], "rule.name": "permit-all", "server.bytes": 686432, "server.ip": "5.0.0.1", @@ -1328,11 +1313,12 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "4.0.0.1", - "5.0.0.1", "4.0.0.1", "5.0.0.1" ], + "related.user": [ + "user1" + ], "rule.name": "permit-all", "server.ip": "5.0.0.1", "server.nat.port": 80, @@ -1417,11 +1403,12 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "4.0.0.1", - "5.0.0.1", "4.0.0.1", "5.0.0.1" ], + "related.user": [ + "user1" + ], "rule.name": "permit-all", "server.bytes": 646, "server.ip": "5.0.0.1", @@ -1495,8 +1482,6 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "50.0.0.100", - "30.0.0.100", "50.0.0.100", "30.0.0.100" ], @@ -1637,11 +1622,12 @@ "observer.type": "firewall", "observer.vendor": "Juniper", "related.ip": [ - "4.0.0.1", - "5.0.0.1", "4.0.0.1", "5.0.0.1" ], + "related.user": [ + "user1" + ], "rule.name": "permit-all", "server.bytes": 646, "server.ip": "5.0.0.1", @@ -1733,8 +1719,7 @@ "related.ip": [ "10.1.1.100", "46.165.154.241", - "172.19.34.100", - "46.165.154.241" + "172.19.34.100" ], "rule.name": "default-permit", "server.bytes": 2132, @@ -1829,8 +1814,7 @@ "related.ip": [ "10.1.1.100", "91.228.167.172", - "172.19.34.100", - "91.228.167.172" + "172.19.34.100" ], "rule.name": "default-permit", "server.bytes": 9670, @@ -1906,8 +1890,7 @@ "related.ip": [ "10.1.1.100", "8.8.8.8", - "172.19.34.100", - "8.8.8.8" + "172.19.34.100" ], "rule.name": "default-permit", "server.ip": "8.8.8.8", @@ -1989,8 +1972,7 @@ "related.ip": [ "10.1.1.100", "8.8.8.8", - "172.19.34.100", - "8.8.8.8" + "172.19.34.100" ], "rule.name": "default-permit", "server.bytes": 82, diff --git a/x-pack/filebeat/module/juniper/srx/test/idp.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/idp.log-expected.json index 8a5a73073558..71faf19efc7b 100644 --- a/x-pack/filebeat/module/juniper/srx/test/idp.log-expected.json +++ b/x-pack/filebeat/module/juniper/srx/test/idp.log-expected.json @@ -67,6 +67,9 @@ "0.0.0.0", "3.3.10.11" ], + "related.user": [ + "unknown-user" + ], "rule.id": "3", "rule.name": "IPS", "server.bytes": 0, @@ -155,6 +158,9 @@ "0.0.0.0", "3.3.10.11" ], + "related.user": [ + "unknown-user" + ], "rule.id": "3", "rule.name": "IPS", "server.bytes": 0, diff --git a/x-pack/filebeat/module/juniper/srx/test/utm.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/utm.log-expected.json index 6b0aa31072fa..1da203ed4510 100644 --- a/x-pack/filebeat/module/juniper/srx/test/utm.log-expected.json +++ b/x-pack/filebeat/module/juniper/srx/test/utm.log-expected.json @@ -49,6 +49,9 @@ "192.168.1.100", "103.235.46.39" ], + "related.user": [ + "user01" + ], "server.ip": "103.235.46.39", "server.port": 80, "service.type": "juniper", @@ -108,6 +111,9 @@ "10.10.10.50", "216.200.241.66" ], + "related.user": [ + "user02" + ], "server.ip": "216.200.241.66", "server.port": 80, "service.type": "juniper", @@ -320,6 +326,9 @@ "related.ip": [ "10.10.10.1" ], + "related.user": [ + "user01" + ], "service.type": "juniper", "source.ip": "10.10.10.1", "source.user.name": "user01", @@ -372,6 +381,9 @@ "192.0.2.3", "198.51.100.2" ], + "related.user": [ + "user01@testuser.com" + ], "server.ip": "198.51.100.2", "server.port": 80, "service.type": "juniper", @@ -433,6 +445,9 @@ "192.168.1.100", "103.235.46.39" ], + "related.user": [ + "user01" + ], "server.ip": "103.235.46.39", "server.port": 80, "service.type": "juniper",