Cyberark Privileged Access Security module by adriansr · Pull Request #24803 · elastic/beats

adriansr · 2021-03-29T07:48:07Z

This PR adds a new module, cyberarkpas, to ingest Privileged Access Security audit logs from Vault via syslog.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

[ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Dashboard:

Logs

elasticmachine · 2021-03-29T07:48:09Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

adriansr

Notes to reviewers.

Don't be overwhelmed by the size of the PR. Most of it are sample logs that I plan to reduce.

adriansr · 2021-03-29T07:55:30Z

x-pack/filebeat/module/cyberarkpas/_meta/assets/elastic-json-v1.0.xsl

This file is necessary to configure the Vault, but it's not used by the module. Added it here so that it's under version control. We need to see how to distribute it.

x-pack/filebeat/module/cyberarkpas/_meta/config.yml

x-pack/filebeat/module/cyberarkpas/_meta/docs.asciidoc

x-pack/filebeat/module/cyberarkpas/audit/_meta/fields.yml

adriansr · 2021-03-29T07:58:25Z

x-pack/filebeat/module/cyberarkpas/audit/ingest/pipeline.yml

TODO: Most of these comments can be moved to a description field.

adriansr · 2021-03-29T07:59:20Z

x-pack/filebeat/module/cyberarkpas/audit/ingest/pipeline.yml

Note to reviewers: Please review these mappings

elasticmachine · 2021-03-29T08:48:50Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Build Cause: Pull request #24803 updated
Start Time: 2021-04-19T20:17:50.518+0000
Duration: 69 min 43 sec
Commit: d739863

Test stats 🧪

Test	Results
Failed	0
Passed	13608
Skipped	2271
Total	15879

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	13608
Skipped	2271
Total	15879

adriansr · 2021-04-15T22:18:29Z

/test

andrewkroh

Thanks documenting the pipeline so well!

andrewkroh · 2021-04-16T00:05:42Z

x-pack/filebeat/module/cyberarkpas/audit/config/input.yml

Is this for adding network_direction? We do have that available in Ingest Node too now.

Thanks, I added the ingest node processor. However, I don't see a way for the user to pass custom internal networks in a way that's compatible with packages. Any ideas?

x-pack/filebeat/module/cyberarkpas/audit/ingest/pipeline.yml

filebeat/docs/fields.asciidoc

Technically it should escape all control characters (0-0x1f) but I can't find a way to do that in XSLT v1.0. Only TAB, CR and LF can be represented.

This PR adds a new module, cyberarkpas, to ingest Privileged Access Security audit logs from Vault via syslog. (cherry picked from commit 2d51864)

…-github-pr-comment-template * upstream/master: [Ingest Manager] Keep http and logging config during enroll (elastic#25132) Refactor kubernetes autodiscover to avoid skipping short-living pods (elastic#24742) [libbeat] New decode xml wineventlog processor (elastic#25115) Add svc to agent k8s clusterRole (elastic#25146) Add awsfargate module to collect container logs from Amazon ECS on Fargate (elastic#25041) [Filebeat][Cisco ASA] log enhancement and performance (elastic#24744) Watch kubernetes namespaces for autodiscover metadata for pods (elastic#25117) Cyberark Privileged Access Security module (elastic#24803) [Elastic Agent] Log the container command output with LOGS_PATH (elastic#25150) Fix for tests after `device...` field has been removed (elastic#25141) [Ingest Manager] Restart process on output change (elastic#24907) Set --insecure in container when FLEET_SERVER_ENABLE and FLEET_INSECURE set. (elastic#25137) [filebeat] Update documentation / changelog / beta warnings for the syslog input (elastic#25047) Add support for ignore_inactive in filestream input (elastic#25036) Fix bug with annotations dedot config on k8s not used (elastic#25111)

This PR adds a new module, cyberarkpas, to ingest Privileged Access Security audit logs from Vault via syslog. (cherry picked from commit 2d51864)

Adds a new package, cyberarkpas, for Cyberark Privileged Access Security audit logs (from elastic/beats#24803)

adriansr added enhancement in progress Pull request is currently in progress. Filebeat Filebeat Team:Security-External Integrations labels Mar 29, 2021

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Mar 29, 2021

adriansr closed this Mar 29, 2021

adriansr reopened this Mar 29, 2021

adriansr marked this pull request as draft March 29, 2021 07:48

adriansr commented Mar 29, 2021

View reviewed changes

adriansr force-pushed the cyberarkpas branch 3 times, most recently from 727eb7d to 2a461e5 Compare April 6, 2021 09:50

adriansr added review backport-v7.13.0 Automated backport with mergify and removed in progress Pull request is currently in progress. labels Apr 15, 2021

adriansr marked this pull request as ready for review April 15, 2021 14:48

adriansr changed the title ~~[WIP] Cyberark Privileged Account Security module~~ Cyberark Privileged Access Security module Apr 15, 2021

andrewkroh reviewed Apr 16, 2021

View reviewed changes

adriansr force-pushed the cyberarkpas branch from c6df13e to de62045 Compare April 19, 2021 08:34

marc-gr reviewed Apr 19, 2021

View reviewed changes

filebeat/docs/fields.asciidoc Outdated Show resolved Hide resolved

andrewkroh approved these changes Apr 19, 2021

View reviewed changes

adriansr added 5 commits April 19, 2021 22:14

Cyberarkpas module skeleton

1da5826

Save Cyberark transform XSLT file

599b7aa

XSL: Escape some control characters

c6d2ac0

Technically it should escape all control characters (0-0x1f) but I can't find a way to do that in XSLT v1.0. Only TAB, CR and LF can be represented.

Mage update

79c4752

WIP

f94039e

adriansr added 21 commits April 19, 2021 22:14

Update dashboard again

be6cb78

Fix double backslashes

03002d2

Use triple braces for mustache in processors

43a1cb8

Remove duplicate observer fields

0fd761b

No need to populate host.hostname

d565794

Remove duplicated message_id

b71a273

More triple braces for mustache

552d9e4

Mage update

6f3a77d

Comment improvements

d846f02

Disable debug in XSL file

68ecae8

Update XSL link.

d7b0bd2

Add changelog entry

11dc572

Remove redundant test logs

86dceae

Add network_direction

57123d2

Use correct log.syslog.priority

1685391

Re-generate golden files with newer 7.13 ES

adfc531

Determine if a field is a valid IP address the 7.13 way

4a958f2

Add station/gateway_station to related.ip

0a02a6b

Remove bogus XSL distribution claim from docs

1e807b3

Add description to script processors

0fabc9f

Make rfc5424 field a boolean

d739863

adriansr force-pushed the cyberarkpas branch from e3251a9 to d739863 Compare April 19, 2021 20:16

adriansr merged commit 2d51864 into elastic:master Apr 19, 2021

mergify bot pushed a commit that referenced this pull request Apr 19, 2021

Cyberark Privileged Access Security module (#24803)

d79156c

This PR adds a new module, cyberarkpas, to ingest Privileged Access Security audit logs from Vault via syslog. (cherry picked from commit 2d51864)

mergify bot mentioned this pull request Apr 19, 2021

Cyberark Privileged Access Security module (backport #24803) #25156

Merged

adriansr mentioned this pull request Apr 20, 2021

Add package for Cyberark Privileged Access Security audit logs elastic/integrations#928

Merged

3 tasks

adriansr added a commit to elastic/integrations that referenced this pull request May 12, 2021

Add package for Cyberark Privileged Access Security audit logs (#928)

c33bc4f

Adds a new package, cyberarkpas, for Cyberark Privileged Access Security audit logs (from elastic/beats#24803)

Conversation

adriansr commented Mar 29, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Author's Checklist

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

Uh oh!

elasticmachine commented Mar 29, 2021

Uh oh!

adriansr left a comment

Choose a reason for hiding this comment

Uh oh!

adriansr Mar 29, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adriansr Mar 29, 2021

Choose a reason for hiding this comment

Uh oh!

adriansr Mar 29, 2021

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 29, 2021 • edited by jenkins-beats-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

Trends 🧪

💚 Flaky test report

Test stats 🧪

Uh oh!

adriansr commented Apr 15, 2021

Uh oh!

andrewkroh left a comment

Choose a reason for hiding this comment

Uh oh!

andrewkroh Apr 16, 2021

Choose a reason for hiding this comment

Uh oh!

adriansr Apr 18, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

adriansr commented Mar 29, 2021 •

edited

Loading

elasticmachine commented Mar 29, 2021 •

edited by jenkins-beats-ci bot

Loading