Skip to content

Commit 9c42875

Browse files
maxcoldmaxcold
committed
Merge branch 'main' into csp-add-wiz-misconfigruation-findings-transform
2 parents 6bb05f0 + a90c098 commit 9c42875

48 files changed

Lines changed: 622 additions & 53 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.buildkite/pipeline.schedule-daily.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ steps:
2121
env:
2222
SERVERLESS: "false"
2323
FORCE_CHECK_ALL: "true"
24-
STACK_VERSION: 7.17.24-SNAPSHOT
24+
STACK_VERSION: 7.17.25-SNAPSHOT
2525
depends_on:
2626
- step: "check"
2727
allow_failure: false

‎packages/azure/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
- version: "1.15.0"
2+
changes:
3+
- description: Add new section on Azure Functions hosting plans.
4+
type: enhancement
5+
link: https://github.com/elastic/integrations/pull/10984
16
- version: "1.14.0"
27
changes:
38
- description: Add global dataset filter for dashboards to improve performance.

‎packages/azure/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: azure
22
title: Azure Logs
3-
version: 1.14.0
3+
version: 1.15.0
44
description: This Elastic integration collects logs from Azure
55
type: integration
66
icons:

‎packages/azure_functions/_dev/build/docs/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,13 @@
22

33
The Azure Functions integration allows you to monitor Azure Functions. Azure Functions is an event-driven, serverless compute platform that helps you develop more efficiently using the programming language of your choice. Triggers cause a function to run. A trigger defines how a function is invoked and a function must have exactly one trigger.
44

5-
Use this integration to build web APIs, respond to database changes, process IoT streams, manage message queues, and more. Refer common [Azure Functions scenarios](https://learn.microsoft.com/en-us/azure/azure-functions/functions-scenarios?pivots=programming-language-csharp) for more information.
5+
Use Azure Functions to build web APIs, respond to database changes, process IoT streams, manage message queues, and more. Refer common [Azure Functions scenarios](https://learn.microsoft.com/en-us/azure/azure-functions/functions-scenarios?pivots=programming-language-csharp) for more information.
66

7+
## Hosting plans and metrics
8+
9+
Each Azure Functions app requires a hosting plan: Consumption plan, Flex Consumption plan, Premium plan, Dedicated plan, or Container Apps. For more details on the various plans, check the [Azure Functions hosting options](https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale?WT.mc_id=Portal-WebsitesExtension).
10+
11+
These plans differ from eachother in the number of metrics they generate, which are then exported outside of Azure for other monitoring solutions like Elastic Observability. For example, metrics specific to Azure Function Apps, such as 'FunctionExecutionCount' and 'FunctionExecutionUnits', are only available for function apps operating on a Consumption (serverless) plan and are not observed in other plans. On the other hand, all other metrics are generated exclusively for Premium and Dedicated plans and are not available for the Consumption plan.
712

813
## Data streams
914
The Azure Functions integration contains two data streams: [Function App Logs](#logs) and [Metrics](#metrics)

‎packages/azure_functions/docs/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,13 @@
22

33
The Azure Functions integration allows you to monitor Azure Functions. Azure Functions is an event-driven, serverless compute platform that helps you develop more efficiently using the programming language of your choice. Triggers cause a function to run. A trigger defines how a function is invoked and a function must have exactly one trigger.
44

5-
Use this integration to build web APIs, respond to database changes, process IoT streams, manage message queues, and more. Refer common [Azure Functions scenarios](https://learn.microsoft.com/en-us/azure/azure-functions/functions-scenarios?pivots=programming-language-csharp) for more information.
5+
Use Azure Functions to build web APIs, respond to database changes, process IoT streams, manage message queues, and more. Refer common [Azure Functions scenarios](https://learn.microsoft.com/en-us/azure/azure-functions/functions-scenarios?pivots=programming-language-csharp) for more information.
66

7+
## Hosting plans and metrics
8+
9+
Each Azure Functions app requires a hosting plan: Consumption plan, Flex Consumption plan, Premium plan, Dedicated plan, or Container Apps. For more details on the various plans, check the [Azure Functions hosting options](https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale?WT.mc_id=Portal-WebsitesExtension).
10+
11+
These plans differ from eachother in the number of metrics they generate, which are then exported outside of Azure for other monitoring solutions like Elastic Observability. For example, metrics specific to Azure Function Apps, such as 'FunctionExecutionCount' and 'FunctionExecutionUnits', are only available for function apps operating on a Consumption (serverless) plan and are not observed in other plans. On the other hand, all other metrics are generated exclusively for Premium and Dedicated plans and are not available for the Consumption plan.
712

813
## Data streams
914
The Azure Functions integration contains two data streams: [Function App Logs](#logs) and [Metrics](#metrics)

‎packages/citrix_adc/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.8.1"
3+
changes:
4+
- description: "Improve handling of SSLVPN Message."
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/11121
27
- version: "1.8.0"
38
changes:
49
- description: "Allow @custom pipeline access to event.original without setting preserve_original_event."

‎packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-sslvpn-message.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<135> 09/09/2024:14:13:39 PRODSY3VPX01 0-PPE-0 : default SSLVPN Message 30461998 0 : "[Remote ip = 109.117.241.115:5019] {ns_handle_free_resources:13910} freeing sta resource for pcb:{src-ip:port=109.117.241.115:5019} <-> {dst-ip:port=75.60.204.46:443} pcbdevno=0xa14452, user_domain=(, ns_aaa->csg_flags=0x400"

‎packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-sslvpn-message.log-expected.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2024-09-09T14:13:39.000Z",
5+
"citrix": {
6+
"cef_format": false,
7+
"default_class": true,
8+
"detail": "<135> 09/09/2024:14:13:39 PRODSY3VPX01 0-PPE-0 : default SSLVPN Message 30461998 0 : \"[Remote ip = 109.117.241.115:5019] {ns_handle_free_resources:13910} freeing sta resource for pcb:{src-ip:port=109.117.241.115:5019} <-> {dst-ip:port=75.60.204.46:443} pcbdevno=0xa14452, user_domain=(, ns_aaa->csg_flags=0x400\"",
9+
"device_event_class_id": "SSLVPN",
10+
"extended": {
11+
"message": "[Remote ip = 109.117.241.115:5019] {ns_handle_free_resources:13910} freeing sta resource for pcb:{src-ip:port=109.117.241.115:5019} <-> {dst-ip:port=75.60.204.46:443} pcbdevno=0xa14452, user_domain=(, ns_aaa->csg_flags=0x400"
12+
},
13+
"host": "PRODSY3VPX01",
14+
"name": "Message"
15+
},
16+
"citrix_adc": {
17+
"log": {
18+
"message": "[Remote ip = 109.117.241.115:5019] {ns_handle_free_resources:13910} freeing sta resource for pcb:{src-ip:port=109.117.241.115:5019} <-> {dst-ip:port=75.60.204.46:443} pcbdevno=0xa14452, user_domain=(, ns_aaa->csg_flags=0x400"
19+
}
20+
},
21+
"ecs": {
22+
"version": "8.11.0"
23+
},
24+
"event": {
25+
"category": [
26+
"authentication"
27+
],
28+
"id": "30461998",
29+
"original": "<135> 09/09/2024:14:13:39 PRODSY3VPX01 0-PPE-0 : default SSLVPN Message 30461998 0 : \"[Remote ip = 109.117.241.115:5019] {ns_handle_free_resources:13910} freeing sta resource for pcb:{src-ip:port=109.117.241.115:5019} <-> {dst-ip:port=75.60.204.46:443} pcbdevno=0xa14452, user_domain=(, ns_aaa->csg_flags=0x400\"",
30+
"severity": 0,
31+
"timezone": "UTC",
32+
"type": [
33+
"info"
34+
]
35+
},
36+
"observer": {
37+
"product": "Netscaler",
38+
"type": "firewall",
39+
"vendor": "Citrix"
40+
},
41+
"tags": [
42+
"preserve_original_event",
43+
"preserve_duplicate_custom_fields"
44+
]
45+
}
46+
]
47+
}

‎packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/native.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,11 @@ processors:
1010
tag: grok_detail
1111
field: citrix.detail
1212
patterns:
13+
- '^%{SPACE}%{HEADER_NOTIMEZONE} : %{DATA:_tmp.details} : +"%{GREEDYDATA:citrix.extended.message}"'
1314
- '^%{SPACE}%{HEADER} : %{DATA:_tmp.details} : +"%{GREEDYDATA:citrix.extended.message}"'
1415
- '^%{SPACE}%{HEADER} : %{DATA:_tmp.details} : +%{GREEDYDATA:citrix.extended.message}'
1516
pattern_definitions:
17+
HEADER_NOTIMEZONE: '(?:<%{NUMBER}>%{SPACE})?%{NATIVE_TIMESTAMP:_tmp.timestamp_native} (?:%{SYSLOGHOST:citrix.host} )?%{INT}-PPE-%{INT}'
1618
HEADER: '(?:<%{NUMBER}>%{SPACE})?%{NATIVE_TIMESTAMP:_tmp.timestamp_native} %{WORD:event.timezone}? (?:%{SYSLOGHOST:citrix.host} )?%{INT}-PPE-%{INT}'
1719
NATIVE_TIMESTAMP: '(?:%{MONTHNUM}/%{MONTHDAY}/%{YEAR}|%{YEAR}/%{MONTHNUM}/%{MONTHDAY}|%{MONTHDAY}/%{MONTHNUM}/%{YEAR}):%{HOUR}:%{MINUTE}:%{SECOND}'
1820
- grok:
@@ -83,7 +85,7 @@ processors:
8385
- pipeline:
8486
name: '{{ IngestPipeline "sslvpn_and_aaatm_feature" }}'
8587
tag: pipeline_sslvpn_and_aaatm_feature
86-
if: ctx.citrix?.device_event_class_id != null && (ctx.citrix.device_event_class_id == "SSLVPN" || ctx.citrix.device_event_class_id == "AAATM")
88+
if: ctx.citrix?.device_event_class_id != null && ((ctx.citrix.device_event_class_id == "SSLVPN" && !ctx.citrix?.name?.equalsIgnoreCase("MESSAGE")) || ctx.citrix.device_event_class_id == "AAATM")
8789
- pipeline:
8890
name: '{{ IngestPipeline "ci_feature" }}'
8991
tag: pipeline_ci_feature

‎packages/citrix_adc/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.2"
22
name: citrix_adc
33
title: Citrix ADC
4-
version: "1.8.0"
4+
version: "1.8.1"
55
description: This Elastic integration collects logs and metrics from Citrix ADC product.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)