Skip to content

Commit 9129ba8

Browse files
VihasMakwanaVihasMakwana
authored
Merge branch 'main' into fsstat-ignore
2 parents dd5e3ef + 8ec64df commit 9129ba8

9 files changed

Lines changed: 181 additions & 22 deletions

File tree

‎packages/sublime_security/_dev/build/docs/README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@ The Sublime Security integration collects three types of logs:
2222

2323
Elastic Agent must be installed. For more details and installation instructions, please refer to the [Elastic Agent Installation Guide](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html).
2424

25+
## Agentless-enabled integration
26+
27+
Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
28+
29+
Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
30+
2531
### Installing and managing an Elastic Agent:
2632

2733
There are several options for installing and managing Elastic Agent:

‎packages/sublime_security/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.9.0"
3+
changes:
4+
- description: Add agentless deployment.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13963
27
- version: "1.8.2"
38
changes:
49
- description: Fix default request trace enabled behavior.

‎packages/sublime_security/docs/README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@ The Sublime Security integration collects three types of logs:
2222

2323
Elastic Agent must be installed. For more details and installation instructions, please refer to the [Elastic Agent Installation Guide](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html).
2424

25+
## Agentless-enabled integration
26+
27+
Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
28+
29+
Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
30+
2531
### Installing and managing an Elastic Agent:
2632

2733
There are several options for installing and managing Elastic Agent:

‎packages/sublime_security/manifest.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1-
format_version: 3.2.1
1+
format_version: 3.2.3
22
name: sublime_security
33
title: Sublime Security
4-
version: "1.8.2"
4+
version: "1.9.0"
55
description: Collect logs from Sublime Security with Elastic Agent.
66
type: integration
77
categories:
88
- security
99
- email_security
1010
conditions:
1111
kibana:
12-
version: "^8.16.5 || ^9.0.0"
12+
version: "^8.18.0 || ^9.0.0"
1313
elastic:
1414
subscription: basic
1515
screenshots:
@@ -39,6 +39,14 @@ policy_templates:
3939
- name: sublime_security
4040
title: Sublime Security logs
4141
description: Collect Sublime Security logs.
42+
deployment_modes:
43+
default:
44+
enabled: true
45+
agentless:
46+
enabled: true
47+
organization: security
48+
division: engineering
49+
team: security-service-integrations
4250
inputs:
4351
- type: cel
4452
title: Collect Sublime Security logs via API

‎packages/zscaler_zpa/changelog.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
# newer versions go on top
2+
- version: "1.22.2"
3+
changes:
4+
- description: Fix handling of remote IP lists in audit data stream.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/13755
7+
- description: Fix ECS event type, category and outcome mapping of audit events.
8+
type: bugfix
9+
link: https://github.com/elastic/integrations/pull/13755
210
- version: "1.22.1"
311
changes:
412
- description: Do not set `error.message` for expected behavior related to Zscaler `Host` field.

‎packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
{"ModifiedTime":"2021-11-17T04:29:38.000Z","CreationTime":"2021-11-17T04:29:38.000Z","ModifiedBy":12345678901234567,"RequestID":"11111111-1111-1111-1111-111111111111","SessionID":"1idn23nlfm2q1txa5h3r4mep6","AuditOldValue":"","AuditNewValue":"{\"id\":\"72058340288495701\",\"name\":\"Some-Name\",\"domainOrIpAddress\":\"81.2.69.144\",\"description\":\"This is a description field\",\"enabled\":\"true\"}","AuditOperationType":"Create","ObjectType":"Server","ObjectName":"Some-Name","ObjectID":12345678901234567,"CustomerID":98765432109876543,"User":"zpaadmin@xxxxxxxxxxxxxxxxx.zpa-customer.com","ClientAuditUpdate":0}
22
{"ModifiedTime":"","CreationTime":"2021-11-17T04:29:38.000Z","ModifiedBy":12345678901234567,"RequestID":"11111111-1111-1111-1111-111111111111","SessionID":"1idn23nlfm2q1txa5h3r4mep6","AuditOldValue":"","AuditNewValue":"{\"id\":\"72058340288495701\",\"name\":\"Some-Name\",\"domainOrIpAddress\":\"example.com\",\"description\":\"This is a description field\",\"enabled\":\"true\"}","AuditOperationType":"Create","ObjectType":"Server","ObjectName":"Some-Name","ObjectID":12345678901234567,"CustomerID":98765432109876543,"User":"zpaadmin@xxxxxxxxxxxxxxxxx.zpa-customer.com","ClientAuditUpdate":0}
3+
{"ModifiedTime":"","CreationTime":"2025-04-30T16:23:40.000Z","ModifiedBy":288263728720249833,"RequestID":"12d6eccc-718c-4657-b267-83cc1c3f35f6","SessionID":"1samau4fwi7xbsf3317mkd5vz","AuditOldValue":"","AuditNewValue":"{\"loginAttempt\":\"2025-04-30 16:23:40 UTC\",\"remoteIP\":\"81.2.69.142, 81.2.69.144\"}","AuditOperationType":"Sign In","ObjectType":"Authentication","ObjectName":"xxxx","ObjectID":"xxxxx","CustomerID":"xxxxx","User":"xxxx","ClientAuditUpdate":1}

‎packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
"id": "11111111-1111-1111-1111-111111111111",
1414
"kind": "event",
1515
"original": "{\"ModifiedTime\":\"2021-11-17T04:29:38.000Z\",\"CreationTime\":\"2021-11-17T04:29:38.000Z\",\"ModifiedBy\":12345678901234567,\"RequestID\":\"11111111-1111-1111-1111-111111111111\",\"SessionID\":\"1idn23nlfm2q1txa5h3r4mep6\",\"AuditOldValue\":\"\",\"AuditNewValue\":\"{\\\"id\\\":\\\"72058340288495701\\\",\\\"name\\\":\\\"Some-Name\\\",\\\"domainOrIpAddress\\\":\\\"81.2.69.144\\\",\\\"description\\\":\\\"This is a description field\\\",\\\"enabled\\\":\\\"true\\\"}\",\"AuditOperationType\":\"Create\",\"ObjectType\":\"Server\",\"ObjectName\":\"Some-Name\",\"ObjectID\":12345678901234567,\"CustomerID\":98765432109876543,\"User\":\"zpaadmin@xxxxxxxxxxxxxxxxx.zpa-customer.com\",\"ClientAuditUpdate\":0}",
16+
"outcome": "success",
1617
"type": [
1718
"creation"
1819
]
@@ -77,6 +78,7 @@
7778
"id": "11111111-1111-1111-1111-111111111111",
7879
"kind": "event",
7980
"original": "{\"ModifiedTime\":\"\",\"CreationTime\":\"2021-11-17T04:29:38.000Z\",\"ModifiedBy\":12345678901234567,\"RequestID\":\"11111111-1111-1111-1111-111111111111\",\"SessionID\":\"1idn23nlfm2q1txa5h3r4mep6\",\"AuditOldValue\":\"\",\"AuditNewValue\":\"{\\\"id\\\":\\\"72058340288495701\\\",\\\"name\\\":\\\"Some-Name\\\",\\\"domainOrIpAddress\\\":\\\"example.com\\\",\\\"description\\\":\\\"This is a description field\\\",\\\"enabled\\\":\\\"true\\\"}\",\"AuditOperationType\":\"Create\",\"ObjectType\":\"Server\",\"ObjectName\":\"Some-Name\",\"ObjectID\":12345678901234567,\"CustomerID\":98765432109876543,\"User\":\"zpaadmin@xxxxxxxxxxxxxxxxx.zpa-customer.com\",\"ClientAuditUpdate\":0}",
81+
"outcome": "success",
8082
"type": [
8183
"creation"
8284
]
@@ -123,6 +125,72 @@
123125
}
124126
}
125127
}
128+
},
129+
{
130+
"@timestamp": "2025-04-30T16:23:40.000Z",
131+
"client": {
132+
"ip": [
133+
"81.2.69.142",
134+
"81.2.69.144"
135+
]
136+
},
137+
"ecs": {
138+
"version": "8.11.0"
139+
},
140+
"event": {
141+
"category": [
142+
"authentication",
143+
"session"
144+
],
145+
"created": "2025-04-30T16:23:40.000Z",
146+
"id": "12d6eccc-718c-4657-b267-83cc1c3f35f6",
147+
"kind": "event",
148+
"original": "{\"ModifiedTime\":\"\",\"CreationTime\":\"2025-04-30T16:23:40.000Z\",\"ModifiedBy\":288263728720249833,\"RequestID\":\"12d6eccc-718c-4657-b267-83cc1c3f35f6\",\"SessionID\":\"1samau4fwi7xbsf3317mkd5vz\",\"AuditOldValue\":\"\",\"AuditNewValue\":\"{\\\"loginAttempt\\\":\\\"2025-04-30 16:23:40 UTC\\\",\\\"remoteIP\\\":\\\"81.2.69.142, 81.2.69.144\\\"}\",\"AuditOperationType\":\"Sign In\",\"ObjectType\":\"Authentication\",\"ObjectName\":\"xxxx\",\"ObjectID\":\"xxxxx\",\"CustomerID\":\"xxxxx\",\"User\":\"xxxx\",\"ClientAuditUpdate\":1}",
149+
"outcome": "success",
150+
"type": [
151+
"start"
152+
]
153+
},
154+
"organization": {
155+
"id": "xxxxx"
156+
},
157+
"related": {
158+
"ip": [
159+
"81.2.69.142",
160+
"81.2.69.144"
161+
],
162+
"user": [
163+
"288263728720249833",
164+
"xxxx"
165+
]
166+
},
167+
"tags": [
168+
"preserve_original_event"
169+
],
170+
"user": {
171+
"id": "288263728720249833",
172+
"name": "xxxx"
173+
},
174+
"zscaler_zpa": {
175+
"audit": {
176+
"client_audit_update": 1,
177+
"object": {
178+
"id": "xxxxx",
179+
"name": "xxxx",
180+
"type": "Authentication"
181+
},
182+
"operation_type": "Sign In",
183+
"session": {
184+
"id": "1samau4fwi7xbsf3317mkd5vz"
185+
},
186+
"value": {
187+
"new": {
188+
"loginAttempt": "2025-04-30 16:23:40 UTC",
189+
"remoteIP": "81.2.69.142, 81.2.69.144"
190+
}
191+
}
192+
}
193+
}
126194
}
127195
]
128196
}

‎packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 75 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -39,30 +39,74 @@ processors:
3939
field: event.created
4040
copy_from: '@timestamp'
4141
ignore_failure: true
42-
- append:
43-
field: event.category
44-
value: iam
4542
- set:
4643
field: event.kind
4744
value: event
4845
- script:
4946
if: ctx.json?.AuditOperationType != null && ctx.json.AuditOperationType != ''
5047
lang: painless
48+
params:
49+
event_classification:
50+
'create':
51+
type:
52+
- creation
53+
category:
54+
- iam
55+
outcome: success
56+
'delete':
57+
type:
58+
- deletion
59+
category:
60+
- iam
61+
outcome: success
62+
'update':
63+
type:
64+
- change
65+
category:
66+
- iam
67+
outcome: success
68+
'sign in':
69+
type:
70+
- start
71+
category:
72+
- authentication
73+
- session
74+
outcome: success
75+
'sign in failure':
76+
type:
77+
- start
78+
- error
79+
category: failure
80+
- session
81+
outcome:
82+
'download':
83+
type:
84+
- info
85+
- access
86+
outcome: success
87+
category:
88+
- file
89+
'sign out':
90+
type:
91+
- end
92+
category:
93+
- session
94+
outcome: success
95+
'client session revoked':
96+
type:
97+
- change
98+
- deletion
99+
category:
100+
- iam
101+
outcome: success
51102
source: |
52-
def eventType = ctx.json.AuditOperationType?.toLowerCase();
53-
ctx.event.type = new ArrayList();
54-
Map referenceTable = [
55-
'create': ['creation'],
56-
'delete': ['deletion'],
57-
'update': ['change'],
58-
'sign in': ['access', 'allowed'],
59-
'sign in failure': ['access', 'error'],
60-
'download': ['info'],
61-
'sign out': ['access'],
62-
'client session revoked': ['end']
63-
];
64-
65-
ctx.event.type = referenceTable[eventType];
103+
def class = params.event_classification[ctx.json.AuditOperationType?.toLowerCase()];
104+
if (class == null) {
105+
return;
106+
}
107+
ctx.event.type = class.type;
108+
ctx.event.category = class.category;
109+
ctx.event.outcome = class.outcome;
66110
- rename:
67111
field: json.RequestID
68112
target_field: event.id
@@ -216,12 +260,25 @@ processors:
216260
ctx.server = new HashMap();
217261
ctx.server.address = valuesMap?.domainOrIpAddress;
218262
}
263+
- split:
264+
field: client.ip
265+
separator: ', *'
266+
if: ctx.client?.ip instanceof String && ctx.client.ip.contains(',')
219267
- append:
220268
field: related.ip
221269
value: '{{{client.ip}}}'
222-
if: ctx.client?.ip != null
270+
if: ctx.client?.ip instanceof String
223271
allow_duplicates: false
224272
ignore_failure: true
273+
- foreach:
274+
field: client.ip
275+
if: ctx.client?.ip instanceof List
276+
processor:
277+
append:
278+
field: related.ip
279+
value: '{{{_ingest._value}}}'
280+
allow_duplicates: false
281+
ignore_failure: true
225282
- convert:
226283
field: server.address
227284
target_field: server.ip

‎packages/zscaler_zpa/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.3"
22
name: zscaler_zpa
33
title: Zscaler Private Access
4-
version: "1.22.1"
4+
version: "1.22.2"
55
source:
66
license: Elastic-2.0
77
description: Collect logs from Zscaler Private Access (ZPA) with Elastic Agent.

0 commit comments

Comments
 (0)