Skip to content

Commit fe1cf54

Browse files
anil-elasticanil-elastic
authored
Merge branch 'main' into integrations-10151
2 parents 03c51b8 + 31ad9a6 commit fe1cf54

File tree

357 files changed

+24559
-7125
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

357 files changed

+24559
-7125
lines changed

‎.buildkite/pull-requests.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"pipelineSlug": "integrations",
66
"allow_org_users": true,
77
"allowed_repo_permissions": ["admin", "write"],
8-
"allowed_list": ["dependabot[bot]", "mergify[bot]", "elastic-vault-github-plugin-prod[bot]"],
8+
"allowed_list": ["dependabot[bot]", "mergify[bot]", "elastic-vault-github-plugin-prod[bot]", "github-actions[bot]"],
99
"set_commit_status": true,
1010
"build_on_commit": true,
1111
"build_on_comment": true,

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@
158158
/packages/darktrace @elastic/security-service-integrations
159159
/packages/ded @elastic/ml-ui @elastic/sec-applied-ml
160160
/packages/dga @elastic/ml-ui @elastic/sec-applied-ml
161+
/packages/digital_guardian @elastic/security-service-integrations
161162
/packages/docker @elastic/obs-cloudnative-monitoring
162163
/packages/elastic_agent @elastic/elastic-agent
163164
/packages/elastic_package_registry @elastic/ecosystem

‎packages/auth0/_dev/build/docs/README.md‎

Lines changed: 35 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,30 @@
11
# Auth0 Log Streams Integration
22

3-
Auth0 offers integrations that push log events via log streams to Elasticsearch. The [Auth0 Log Streams](https://auth0.com/docs/customize/log-streams) integration package creates a HTTP listener that accepts incoming log events and ingests them into Elasticsearch. This allows you to search, observe and visualize the Auth0 log events through Elasticsearch.
3+
Auth0 offers integrations that push log events via log streams to Elasticsearch or allows an Elastic Agent to make API requests for log events. The [Auth0 Log Streams](https://auth0.com/docs/customize/log-streams) integration package creates a HTTP listener that accepts incoming log events or runs periodic API requests to collect events and ingests them into Elasticsearch. This allows you to search, observe and visualize the Auth0 log events through Elasticsearch.
44

5-
The agent running this integration must be able to accept requests from the Internet in order for Auth0 to be able connect. Auth0 requires that the webhook accept requests over HTTPS. So you must either configure the integration with a valid TLS certificate or use a reverse proxy in front of the integration.
6-
7-
For more information, see Auth0's webpage on [integration to Elastic Security](https://marketplace.auth0.com/integrations/elastic-security).
8-
9-
## Compatability
5+
## Compatibility
106

11-
The package collects log events sent via log stream webhooks.
7+
The package collects log events either sent via log stream webhooks, or by API request to the Auth0 v2 API.
128

13-
## Configuration
14-
15-
### Enabling the integration in Elastic
9+
## Enabling the integration in Elastic
1610

1711
1. In Kibana go to **Management > Integrations**
1812
2. In "Search for integrations" search bar type **Auth0**
1913
3. Click on "Auth0" integration from the search results.
2014
4. Click on **Add Auth0** button to add Auth0 integration.
2115

16+
## Configuration for Webhook input
17+
18+
The agent running this integration must be able to accept requests from the Internet in order for Auth0 to be able connect. Auth0 requires that the webhook accept requests over HTTPS. So you must either configure the integration with a valid TLS certificate or use a reverse proxy in front of the integration.
19+
20+
For more information, see Auth0's webpage on [integration to Elastic Security](https://marketplace.auth0.com/integrations/elastic-security).
21+
2222
### Configure the Auth0 integration
2323

24-
1. Enter values for "Listen Address", "Listen Port" and "Webhook path" to form the endpoint URL. Make note of the **Endpoint URL** `https://{AGENT_ADDRESS}:8383/auth0/logs`.
25-
2. Enter value for "Secret value". This must match the "Authorization Token" value entered when configuring the "Custom Webhook" from Auth0 cloud.
26-
3. Enter values for "TLS". Auth0 requires that the webhook accept requests over HTTPS. So you must either configure the integration with a valid TLS certificate or use a reverse proxy in front of the integration.
24+
1. Click on **Collect Auth0 log streams events via Webhooks** to enable it.
25+
2. Enter values for "Listen Address", "Listen Port" and "Webhook path" to form the endpoint URL. Make note of the **Endpoint URL** `https://{AGENT_ADDRESS}:8383/auth0/logs`.
26+
3. Enter value for "Secret value". This must match the "Authorization Token" value entered when configuring the "Custom Webhook" from Auth0 cloud.
27+
4. Enter values for "TLS". Auth0 requires that the webhook accept requests over HTTPS. So you must either configure the integration with a valid TLS certificate or use a reverse proxy in front of the integration.
2728

2829
### Creating the stream in Auth0
2930

@@ -33,8 +34,27 @@ The package collects log events sent via log stream webhooks.
3334
4. In **Payload URL**, paste the **Endpoint URL** collected during Step 1 of **Configure the Auth0 integration** section.
3435
5. In **Authorization Token**, paste the **Authorization Token**. This must match the value entered in Step 2 of **Configure the Auth0 integration** section.
3536
6. In **Content Type**, choose **application/json**.
36-
7. In **Content Format**, choose **JSON Lines**.
37-
8. **Click Save**.
37+
7. In **Content Format**, choose **JSON Lines**.
38+
8. Click **Save**.
39+
40+
## Configuration for API request input
41+
42+
### Creating an application in Auth0
43+
44+
1. From the Auth0 management console, navigate to **Applications > Applications** and click **+ Create Application**.
45+
2. Choose **Machine to Machine Application**.
46+
3. Name the new **Application** appropriately (e.g. Elastic) and click **Create**.
47+
4. Select the **Auth0 Management API** option and click **Authorize**.
48+
5. Select the `read:logs` and `read:logs_users` permissions and then click **Authorize**.
49+
6. Navigate to the **Settings** tab. Take note of the "Domain", "Client ID" and "Client Secret" values in the **Basic Information** section.
50+
7. Click **Save Changes**.
51+
52+
### Configure the Auth0 integration
53+
54+
1. In the Elastic Auth0 integration user interface click on **Collect Auth0 log events via API requests** to enable it.
55+
2. Enter value for "URL". This must be an https URL using the **Domain** value obtained from Auth cloud above.
56+
3. Enter value for "Client ID". This must match the "Client ID" value obtained from Auth0 cloud above.
57+
4. Enter value for "Client Secret". This must match the "Client Secret" value obtained from Auth0 cloud above.
3858

3959
## Log Events
4060

‎packages/auth0/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,16 @@ services:
1919
- STREAM_WEBHOOK_HEADER=Authorization=abc123
2020
- STREAM_INSECURE=true
2121
command: log --start-signal=SIGHUP --delay=5s /sample_logs/auth0-ndjson.log
22+
auth0-http-server:
23+
image: docker.elastic.co/observability/stream:v0.15.0
24+
hostname: auth0
25+
ports:
26+
- 8090
27+
volumes:
28+
- ./files:/files:ro
29+
environment:
30+
PORT: '8090'
31+
command:
32+
- http-server
33+
- --addr=:8090
34+
- --config=/files/config-logs.yml

‎packages/auth0/_dev/deploy/docker/files/config-logs.yml‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
rules:
2+
- path: /oauth/token
3+
methods: ['POST']
4+
request_body: '{"audience":"http://svc-auth0-http-server:8090/api/v2/","client_id":"wwwwwwww","client_secret":"xxxxxxxx","grant_type":"client_credentials"}'
5+
responses:
6+
- status_code: 200
7+
headers:
8+
Content-Type:
9+
- 'application/json'
10+
body: |
11+
{"access_token":"yyyyyyyy","scope":"read:logs read:logs_users","expires_in":86400,"token_type":"Bearer"}
12+
- path: /api/v2/logs
13+
methods: ['GET']
14+
request_headers:
15+
Authorization:
16+
- "Bearer yyyyyyyy"
17+
query_params:
18+
from: "{from:900[0-9]{20}0{33}}"
19+
take: 1
20+
responses:
21+
- status_code: 200
22+
headers:
23+
Content-Type:
24+
- application/json
25+
Link:
26+
- <http://svc-auth0-http-server:8090/api/v2/logs?from=90020240308035905601176000000000000001223372052035100532&take=1>; rel="next"
27+
body: |-
28+
{{ minify_json `
29+
[
30+
{
31+
"date": "2024-03-08T03:59:05.520Z",
32+
"type": "sapi",
33+
"description": "Create client grant",
34+
"client_id": "xZjM1MjUxOGVhYzYxNTAxZmE3NmI1MGIgIC",
35+
"client_name": "",
36+
"ip": "81.2.69.144",
37+
"user_agent": "Firefox 125.0.0 / Arch 0.0.0",
38+
"details": {
39+
"request": {
40+
"method": "post",
41+
"path": "/api/v2/client-grants",
42+
"query": {},
43+
"userAgent": "Mozilla/5.0 (X11; Arch; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0",
44+
"body": {
45+
"client_id": "MWNhMmRiOGY5MGIxNjE0ZTVmMjc0NDhl",
46+
"audience": "https://dev-fulaoenaspapatoulp.us.auth0.com/api/v2/",
47+
"scope": [
48+
"read:logs",
49+
"read:logs_users"
50+
]
51+
},
52+
"channel": "https://manage.auth0.com/",
53+
"ip": "81.2.69.144",
54+
"auth": {
55+
"user": {
56+
"user_id": "github|32487232",
57+
"name": "User McUserface",
58+
"email": "user.mcuserface@company.com"
59+
},
60+
"strategy": "jwt",
61+
"credentials": {
62+
"jti": "e01983470586edb819c8c5d9967a63d3"
63+
}
64+
}
65+
},
66+
"response": {
67+
"statusCode": 201,
68+
"body": {
69+
"client_id": "MWNhMmRiOGY5MGIxNjE0ZTVmMjc0NDhl",
70+
"audience": "https://dev-fulaoenaspapatoulp.us.auth0.com/api/v2/",
71+
"scope": [
72+
"read:logs",
73+
"read:logs_users"
74+
]
75+
}
76+
}
77+
},
78+
"user_id": "github|32487232",
79+
"$event_schema": {
80+
"version": "1.0.0"
81+
},
82+
"log_id": "90020240308035905601176000000000000001223372052035100532",
83+
"tenant_name": "dev-fulaoenaspapatoulp",
84+
"_id": "90020240308035905601176000000000000001223372052035100532",
85+
"isMobile": false
86+
}
87+
]
88+
` }}
89+
- path: /api/v2/logs
90+
methods: ['GET']
91+
request_headers:
92+
Authorization:
93+
- "Bearer yyyyyyyy"
94+
query_params:
95+
from: "90020240308035905601176000000000000001223372052035100532"
96+
take: 1
97+
responses:
98+
- status_code: 200
99+
headers:
100+
Content-Type:
101+
- application/json
102+
Link:
103+
- <http://svc-auth0-http-server:8090/api/v2/logs?from=90020240308035906742643000000000000001223372052035101088&take=1>; rel="next"
104+
body: |-
105+
{{ minify_json `
106+
[
107+
{
108+
"date": "2024-03-08T03:59:06.700Z",
109+
"type": "mgmt_api_read",
110+
"description": "Get client by ID",
111+
"client_id": "xZjM1MjUxOGVhYzYxNTAxZmE3NmI1MGIgIC",
112+
"client_name": "",
113+
"ip": "81.2.69.144",
114+
"user_agent": "Firefox 125.0.0 / Arch 0.0.0",
115+
"details": {
116+
"accessedSecrets": [
117+
"client_secret"
118+
],
119+
"request": {
120+
"method": "get",
121+
"path": "/api/v2/clients/MWNhMmRiOGY5MGIxNjE0ZTVmMjc0NDhl",
122+
"query": {},
123+
"userAgent": "Mozilla/5.0 (X11; Arch; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0",
124+
"channel": "https://manage.auth0.com/",
125+
"ip": "81.2.69.144",
126+
"auth": {
127+
"user": {
128+
"user_id": "github|32487232",
129+
"name": "User McUserface",
130+
"email": "user.mcuserface@company.com"
131+
},
132+
"strategy": "jwt",
133+
"credentials": {
134+
"jti": "e01983470586edb819c8c5d9967a63d3"
135+
}
136+
}
137+
},
138+
"response": {
139+
"statusCode": 200,
140+
"body": {
141+
"client_id": "MWNhMmRiOGY5MGIxNjE0ZTVmMjc0NDhl"
142+
}
143+
}
144+
},
145+
"user_id": "github|32487232",
146+
"$event_schema": {
147+
"version": "1.0.0"
148+
},
149+
"log_id": "90020240308035906742643000000000000001223372052035101088",
150+
"tenant_name": "dev-fulaoenaspapatoulp",
151+
"_id": "90020240308035906742643000000000000001223372052035101088",
152+
"isMobile": false
153+
}
154+
]
155+
` }}
156+
- path: /api/v2/logs
157+
methods: ['GET']
158+
request_headers:
159+
Authorization:
160+
- "Bearer yyyyyyyy"
161+
query_params:
162+
from: "90020240308035906742643000000000000001223372052035101088"
163+
take: 1
164+
responses:
165+
- status_code: 200
166+
headers:
167+
Content-Type:
168+
- application/json
169+
Link:
170+
- <http://svc-auth0-http-server:8090/api/v2/logs?from=90020240308035906742643000000000000001223372052035101088&take=1>; rel="next"
171+
body: '[]'

‎packages/auth0/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.17.0"
3+
changes:
4+
- description: Add pull v2/logs API input.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/10656
27
- version: "1.16.0"
38
changes:
49
- description: Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template.

0 commit comments

Comments
 (0)