Skip to content

Commit 08eafa3

Browse files
efd6efd6
authored
o365: ensure that IDs are not rendered with e-notation (elastic#14428)
Due to JSON serialisation, numeric IDs may be rendered with e-notation during flight. Ensure that this does not get fossilised into the documents when they are converted to strings.
1 parent ba8d0a4 commit 08eafa3

File tree

5 files changed

+166
-21
lines changed

5 files changed

+166
-21
lines changed

‎packages/o365/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.18.5"
3+
changes:
4+
- description: Ensure numeric Yammer IDs are not rendered with E-notation.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/14428
27
- version: "2.18.4"
38
changes:
49
- description: Fix handling of floating point encoded file sizes.

‎packages/o365/data_stream/audit/_dev/test/pipeline/test-yammer-events.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,33 @@
4747
"Workload": "Yammer",
4848
"YammerNetworkId": 5846122497
4949
}
50+
},
51+
{
52+
"event": {
53+
"original": "{\"ActorUserId\":\"[email protected]\",\"ActorYammerUserId\":3.6085768193E10,\"YammerNetworkId\":2.7182818285E10,\"ClientIP\":\"[fdfd::555]:12346\",\"CreationTime\":\"2020-02-28T09:39:20\",\"GroupName\":\"Company group\",\"Id\":\"3f3e7f1c-84c1-55fc-9bb2-c8b8563eae06\",\"ObjectId\":\"Company group\",\"Operation\":\"GroupCreation\",\"OrganizationId\":\"0e1dddce-163e-4b0b-9e33-87ba56ac4655\",\"RecordType\":22,\"ResultStatus\":\"TRUE\",\"UserId\":\"[email protected]\",\"UserKey\":\"100320009d292e16\",\"UserType\":0,\"LogonType\":1E2,\"InternalLogonType\":1E2,\"Version\":1E1,\"Workload\":\"Yammer\",\"YammerNetworkId\":5.846122497E9}"
54+
},
55+
"o365audit": {
56+
"ActorUserId": "[email protected]",
57+
"ActorYammerUserId": 3.6085768193E10,
58+
"YammerNetworkId": 2.7182818285E10,
59+
"ClientIP": "[fdfd::555]:12346",
60+
"CreationTime": "2020-02-28T09:39:20",
61+
"GroupName": "Company group",
62+
"Id": "3f3e7f1c-84c1-55fc-9bb2-c8b8563eae06",
63+
"ObjectId": "Company group",
64+
"Operation": "GroupCreation",
65+
"OrganizationId": "0e1dddce-163e-4b0b-9e33-87ba56ac4655",
66+
"RecordType": 22,
67+
"ResultStatus": "TRUE",
68+
"UserId": "[email protected]",
69+
"UserKey": "100320009d292e16",
70+
"UserType": 0,
71+
"LogonType": 1E2,
72+
"InternalLogonType": 1E2,
73+
"Version": 1E1,
74+
"Workload": "Yammer",
75+
"YammerNetworkId": 5.846122497E9
76+
}
5077
}
5178
]
5279
}

‎packages/o365/data_stream/audit/_dev/test/pipeline/test-yammer-events.json-expected.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,85 @@
165165
"id": "[email protected]",
166166
"name": "asr"
167167
}
168+
},
169+
{
170+
"@timestamp": "2020-02-28T09:39:20.000Z",
171+
"client": {
172+
"address": "fdfd::555",
173+
"ip": "fdfd::555",
174+
"port": 12346
175+
},
176+
"ecs": {
177+
"version": "8.11.0"
178+
},
179+
"event": {
180+
"action": "GroupCreation",
181+
"category": [
182+
"web",
183+
"iam"
184+
],
185+
"code": "Yammer",
186+
"id": "3f3e7f1c-84c1-55fc-9bb2-c8b8563eae06",
187+
"kind": "event",
188+
"original": "{\"ActorUserId\":\"[email protected]\",\"ActorYammerUserId\":3.6085768193E10,\"YammerNetworkId\":2.7182818285E10,\"ClientIP\":\"[fdfd::555]:12346\",\"CreationTime\":\"2020-02-28T09:39:20\",\"GroupName\":\"Company group\",\"Id\":\"3f3e7f1c-84c1-55fc-9bb2-c8b8563eae06\",\"ObjectId\":\"Company group\",\"Operation\":\"GroupCreation\",\"OrganizationId\":\"0e1dddce-163e-4b0b-9e33-87ba56ac4655\",\"RecordType\":22,\"ResultStatus\":\"TRUE\",\"UserId\":\"[email protected]\",\"UserKey\":\"100320009d292e16\",\"UserType\":0,\"LogonType\":1E2,\"InternalLogonType\":1E2,\"Version\":1E1,\"Workload\":\"Yammer\",\"YammerNetworkId\":5.846122497E9}",
189+
"outcome": "success",
190+
"provider": "Yammer",
191+
"type": [
192+
"info",
193+
"creation",
194+
"group"
195+
]
196+
},
197+
"group": {
198+
"name": "Company group"
199+
},
200+
"host": {
201+
"id": "0e1dddce-163e-4b0b-9e33-87ba56ac4655",
202+
"name": "testsiem2.onmicrosoft.com"
203+
},
204+
"network": {
205+
"type": "ipv6"
206+
},
207+
"o365": {
208+
"audit": {
209+
"ActorYammerUserId": "36085768193",
210+
"CreationTime": "2020-02-28T09:39:20",
211+
"InternalLogonType": "100",
212+
"LogonType": "100",
213+
"ObjectId": "Company group",
214+
"RecordType": "22",
215+
"ResultStatus": "TRUE",
216+
"UserId": "[email protected]",
217+
"UserKey": "100320009d292e16",
218+
"UserType": "0",
219+
"Version": "10",
220+
"YammerNetworkId": "5846122497"
221+
}
222+
},
223+
"organization": {
224+
"id": "0e1dddce-163e-4b0b-9e33-87ba56ac4655"
225+
},
226+
"related": {
227+
"ip": [
228+
"fdfd::555"
229+
],
230+
"user": [
231+
"asr"
232+
]
233+
},
234+
"source": {
235+
"ip": "fdfd::555",
236+
"port": 12346
237+
},
238+
"tags": [
239+
"preserve_original_event"
240+
],
241+
"user": {
242+
"domain": "testsiem2.onmicrosoft.com",
243+
"email": "[email protected]",
244+
"id": "[email protected]",
245+
"name": "asr"
246+
}
168247
}
169248
]
170249
}

‎packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 54 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -938,6 +938,15 @@ processors:
938938
target_field: destination.user.email
939939
ignore_missing: true
940940
if: ctx.event?.code == "Yammer"
941+
- script:
942+
description: Ensure that user IDs are not rendered with e-notation, general fallback for all other cases.
943+
if: ctx.o365audit?.TargetYammerUserId != null
944+
source: |-
945+
if (ctx.o365audit.TargetYammerUserId instanceof double) {
946+
ctx.o365audit.TargetYammerUserId = ((long)ctx.o365audit.TargetYammerUserId).toString();
947+
} else {
948+
ctx.o365audit.TargetYammerUserId = ctx.o365audit.TargetYammerUserId.toString();
949+
}
941950
- rename:
942951
field: o365audit.TargetYammerUserId
943952
target_field: destination.user.id
@@ -1285,26 +1294,51 @@ processors:
12851294
tag: convert_target_type_to_string
12861295
type: string
12871296
ignore_missing: true
1288-
- convert:
1289-
field: o365audit.Version
1290-
type: string
1291-
ignore_missing: true
1292-
- convert:
1293-
field: o365audit.InternalLogonType
1294-
type: string
1295-
ignore_missing: true
1296-
- convert:
1297-
field: o365audit.LogonType
1298-
type: string
1299-
ignore_missing: true
1300-
- convert:
1301-
field: o365audit.ActorYammerUserId
1302-
type: string
1303-
ignore_missing: true
1304-
- convert:
1305-
field: o365audit.YammerNetworkId
1306-
type: string
1307-
ignore_missing: true
1297+
- script:
1298+
description: Ensure that versions are not rendered with e-notation, general fallback for all other cases.
1299+
if: ctx.o365audit?.Version != null
1300+
source: |-
1301+
if (ctx.o365audit.Version instanceof double) {
1302+
ctx.o365audit.Version = ((long)ctx.o365audit.Version).toString();
1303+
} else {
1304+
ctx.o365audit.Version = ctx.o365audit.Version.toString();
1305+
}
1306+
- script:
1307+
description: Ensure that internal logon types are not rendered with e-notation, general fallback for all other cases.
1308+
if: ctx.o365audit?.InternalLogonType != null
1309+
source: |-
1310+
if (ctx.o365audit.InternalLogonType instanceof double) {
1311+
ctx.o365audit.InternalLogonType = ((long)ctx.o365audit.InternalLogonType).toString();
1312+
} else {
1313+
ctx.o365audit.InternalLogonType = ctx.o365audit.InternalLogonType.toString();
1314+
}
1315+
- script:
1316+
description: Ensure that logon types are not rendered with e-notation, general fallback for all other cases.
1317+
if: ctx.o365audit?.LogonType != null
1318+
source: |-
1319+
if (ctx.o365audit.LogonType instanceof double) {
1320+
ctx.o365audit.LogonType = ((long)ctx.o365audit.LogonType).toString();
1321+
} else {
1322+
ctx.o365audit.LogonType = ctx.o365audit.LogonType.toString();
1323+
}
1324+
- script:
1325+
description: Ensure that user IDs are not rendered with e-notation, general fallback for all other cases.
1326+
if: ctx.o365audit?.ActorYammerUserId != null
1327+
source: |-
1328+
if (ctx.o365audit.ActorYammerUserId instanceof double) {
1329+
ctx.o365audit.ActorYammerUserId = ((long)ctx.o365audit.ActorYammerUserId).toString();
1330+
} else {
1331+
ctx.o365audit.ActorYammerUserId = ctx.o365audit.ActorYammerUserId.toString();
1332+
}
1333+
- script:
1334+
description: Ensure that network IDs are not rendered with e-notation, general fallback for all other cases.
1335+
if: ctx.o365audit?.YammerNetworkId != null
1336+
source: |-
1337+
if (ctx.o365audit.YammerNetworkId instanceof double) {
1338+
ctx.o365audit.YammerNetworkId = ((long)ctx.o365audit.YammerNetworkId).toString();
1339+
} else {
1340+
ctx.o365audit.YammerNetworkId = ctx.o365audit.YammerNetworkId.toString();
1341+
}
13081342
- append:
13091343
field: email.message_id
13101344
value: "{{{o365audit.InternetMessageId}}}"

‎packages/o365/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: o365
22
title: Microsoft Office 365
3-
version: "2.18.4"
3+
version: "2.18.5"
44
description: Collect logs from Microsoft Office 365 with Elastic Agent.
55
type: integration
66
format_version: "3.2.3"

0 commit comments

Comments
 (0)