Skip to content

Commit 106d90a

Browse files
taylor-swansontaylor-swanson
authored
[watchguard_firebox] Support email addresses in 2500-0000 and 2500-0001 events (#12909)
- Support email addresses in 2500-0000 and 2500-0001 events and append email address to related.user
1 parent 10a6d56 commit 106d90a

File tree

7 files changed

+164
-3
lines changed

7 files changed

+164
-3
lines changed

‎packages/watchguard_firebox/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.2.0"
3+
changes:
4+
- description: Support email addresses in 2500-0000 and 2500-0001 events.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/12909
27
- version: "1.1.0"
38
changes:
49
- description: ECS version updated to 8.17.0.

‎packages/watchguard_firebox/data_stream/log/_dev/test/pipeline/test-diagnostic.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,5 +175,7 @@
175175
<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id="021A-0020" IKEv2 IKE_AUTH exchange from 81.2.69.144:500 to 81.2.69.144:500 failed. Gateway-Endpoint='m500-197'. Reason=Received message with the wrong interface IP address 81.2.69.144. Expecting peer to use remote gateway endpoint IP address 81.2.69.144.
176176
<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id="2500-0000" Mobile VPN with SSL user tsmith logged in. Virtual IP address is 192.168.113.2. Real IP address is 81.2.69.144.
177177
<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id="2500-0001" Mobile VPN with SSL user tsmith logged off. Virtual IP address is 192.168.113.2.
178+
<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id="2500-0000" Mobile VPN with SSL user [email protected] logged in. Virtual IP address is 192.168.113.2. Real IP address is 81.2.69.144.
179+
<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id="2500-0001" Mobile VPN with SSL user [email protected] logged off. Virtual IP address is 192.168.113.2.
178180
<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id="5B01-0004" Updated Mobile VPN with L2TP session for user 'Firebox-DB\test', virtual IP address '192.168.113.2'.
179181
<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id="5B01-0005" Deleted Mobile VPN with L2TP session for user 'Firebox-DB\test', virtual IP address '192.168.113.2'.

‎packages/watchguard_firebox/data_stream/log/_dev/test/pipeline/test-diagnostic.log-expected.json‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11022,6 +11022,145 @@
1102211022
}
1102311023
}
1102411024
},
11025+
{
11026+
"@timestamp": "2025-05-10T15:19:05.000+05:30",
11027+
"destination": {
11028+
"ip": "192.168.113.2"
11029+
},
11030+
"ecs": {
11031+
"version": "8.17.0"
11032+
},
11033+
"event": {
11034+
"category": [
11035+
"authentication"
11036+
],
11037+
"kind": "event",
11038+
"original": "<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id=\"2500-0000\" Mobile VPN with SSL user [email protected] logged in. Virtual IP address is 192.168.113.2. Real IP address is 81.2.69.144.",
11039+
"outcome": "success",
11040+
"timezone": "+05:30",
11041+
"type": [
11042+
"start"
11043+
]
11044+
},
11045+
"log": {
11046+
"syslog": {
11047+
"appname": "firewall",
11048+
"hostname": "WatchGuard-Firebox",
11049+
"priority": 142,
11050+
"procid": "10"
11051+
}
11052+
},
11053+
"message": "Mobile VPN with SSL user [email protected] logged in. Virtual IP address is 192.168.113.2. Real IP address is 81.2.69.144.",
11054+
"observer": {
11055+
"hostname": "WatchGuard-Firebox",
11056+
"product": "Firebox",
11057+
"serial_number": "FVE6035FD3AE3",
11058+
"type": "firewall",
11059+
"vendor": "WatchGuard"
11060+
},
11061+
"related": {
11062+
"hosts": [
11063+
"WatchGuard-Firebox"
11064+
],
11065+
"ip": [
11066+
"192.168.113.2",
11067+
"81.2.69.144"
11068+
],
11069+
"user": [
11070+
"[email protected]"
11071+
]
11072+
},
11073+
"source": {
11074+
"ip": "81.2.69.144"
11075+
},
11076+
"tags": [
11077+
"preserve_original_event",
11078+
"preserve_duplicate_custom_fields"
11079+
],
11080+
"user": {
11081+
"email": "[email protected]"
11082+
},
11083+
"watchguard_firebox": {
11084+
"log": {
11085+
"log_type": "diagnostic",
11086+
"msg_id": "2500-0000",
11087+
"real_ip_address": "81.2.69.144",
11088+
"serial_number": "FVE6035FD3AE3",
11089+
"syslog_timestamp": "2025-05-10T15:19:05.000+05:30",
11090+
"timestamp": "2024-05-10T09:49:05.000Z",
11091+
"user_email": "[email protected]",
11092+
"virtual_ip_address": "192.168.113.2",
11093+
"vpn_user_type": "Mobile VPN with SSL user"
11094+
}
11095+
}
11096+
},
11097+
{
11098+
"@timestamp": "2025-05-10T15:19:05.000+05:30",
11099+
"destination": {
11100+
"ip": "192.168.113.2"
11101+
},
11102+
"ecs": {
11103+
"version": "8.17.0"
11104+
},
11105+
"event": {
11106+
"category": [
11107+
"authentication"
11108+
],
11109+
"kind": "event",
11110+
"original": "<142>May 10 15:19:05 WatchGuard-Firebox FVE6035FD3AE3 (2024-05-10T09:49:05) firewall[10]: msg_id=\"2500-0001\" Mobile VPN with SSL user [email protected] logged off. Virtual IP address is 192.168.113.2.",
11111+
"outcome": "success",
11112+
"timezone": "+05:30",
11113+
"type": [
11114+
"end"
11115+
]
11116+
},
11117+
"log": {
11118+
"syslog": {
11119+
"appname": "firewall",
11120+
"hostname": "WatchGuard-Firebox",
11121+
"priority": 142,
11122+
"procid": "10"
11123+
}
11124+
},
11125+
"message": "Mobile VPN with SSL user [email protected] logged off. Virtual IP address is 192.168.113.2.",
11126+
"observer": {
11127+
"hostname": "WatchGuard-Firebox",
11128+
"product": "Firebox",
11129+
"serial_number": "FVE6035FD3AE3",
11130+
"type": "firewall",
11131+
"vendor": "WatchGuard"
11132+
},
11133+
"related": {
11134+
"hosts": [
11135+
"WatchGuard-Firebox"
11136+
],
11137+
"ip": [
11138+
"192.168.113.2"
11139+
],
11140+
"user": [
11141+
"[email protected]"
11142+
]
11143+
},
11144+
"tags": [
11145+
"preserve_original_event",
11146+
"preserve_duplicate_custom_fields"
11147+
],
11148+
"user": {
11149+
"email": "[email protected]"
11150+
},
11151+
"watchguard_firebox": {
11152+
"log": {
11153+
"log_type": "diagnostic",
11154+
"msg_id": "2500-0001",
11155+
"serial_number": "FVE6035FD3AE3",
11156+
"syslog_timestamp": "2025-05-10T15:19:05.000+05:30",
11157+
"timestamp": "2024-05-10T09:49:05.000Z",
11158+
"user_email": "[email protected]",
11159+
"virtual_ip_address": "192.168.113.2",
11160+
"vpn_user_type": "Mobile VPN with SSL user"
11161+
}
11162+
}
11163+
},
1102511164
{
1102611165
"@timestamp": "2025-05-10T15:19:05.000+05:30",
1102711166
"destination": {

‎packages/watchguard_firebox/data_stream/log/elasticsearch/ingest_pipeline/pipeline_diagnostic.yml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -600,8 +600,8 @@ processors:
600600
- grok:
601601
field: watchguard_firebox.log.body
602602
patterns:
603-
- '^%{DATA:watchguard_firebox.log.vpn_user_type} %{WORD:watchguard_firebox.log.user_name} logged in. Virtual IP address is %{IP:watchguard_firebox.log.virtual_ip_address}. Real IP address is %{IP:watchguard_firebox.log.real_ip_address}.$'
604-
- '^%{DATA:watchguard_firebox.log.vpn_user_type} %{WORD:watchguard_firebox.log.user_name} logged off. Virtual IP address is %{IP:watchguard_firebox.log.virtual_ip_address}.$'
603+
- '^%{DATA:watchguard_firebox.log.vpn_user_type} (?:%{USERNAME:watchguard_firebox.log.user_name}|%{EMAILADDRESS:watchguard_firebox.log.user_email}) logged in. Virtual IP address is %{IP:watchguard_firebox.log.virtual_ip_address}. Real IP address is %{IP:watchguard_firebox.log.real_ip_address}.$'
604+
- '^%{DATA:watchguard_firebox.log.vpn_user_type} (?:%{USERNAME:watchguard_firebox.log.user_name}|%{EMAILADDRESS:watchguard_firebox.log.user_email}) logged off. Virtual IP address is %{IP:watchguard_firebox.log.virtual_ip_address}.$'
605605
if: ctx.watchguard_firebox?.log?.msg_id != null && ['2500-0000','2500-0001'].contains(ctx.watchguard_firebox.log.msg_id)
606606
tag: grok_for_message_id_2500-0000_2500-0001
607607
ignore_failure: true
@@ -1177,6 +1177,11 @@ processors:
11771177
tag: set_destination_ip_from_log_virtual_ip_address
11781178
copy_from: watchguard_firebox.log.virtual_ip_address
11791179
ignore_empty_value: true
1180+
- set:
1181+
field: user.email
1182+
tag: set_user_email_from_log_user_email
1183+
copy_from: watchguard_firebox.log.user_email
1184+
ignore_empty_value: true
11801185
- gsub:
11811186
field: watchguard_firebox.log.mac
11821187
tag: gsub_watchguard_firebox_log_mac
@@ -1283,6 +1288,12 @@ processors:
12831288
value: '{{{watchguard_firebox.log.user_name}}}'
12841289
allow_duplicates: false
12851290
if: ctx.watchguard_firebox?.log?.user_name != null
1291+
- append:
1292+
field: related.user
1293+
tag: append_log_user_email_into_related_user
1294+
value: '{{{watchguard_firebox.log.user_email}}}'
1295+
allow_duplicates: false
1296+
if: ctx.watchguard_firebox?.log?.user_email != null
12861297
- date:
12871298
field: watchguard_firebox.log.next_update_time
12881299
target_field: watchguard_firebox.log.next_update_time
@@ -1336,6 +1347,7 @@ processors:
13361347
- watchguard_firebox.log.server_name
13371348
- watchguard_firebox.log.source_ip
13381349
- watchguard_firebox.log.source_port
1350+
- watchguard_firebox.log.user_email
13391351
- watchguard_firebox.log.user_name
13401352
- watchguard_firebox.log.virtual_ip_address
13411353
tag: remove_custom_duplicate_fields

‎packages/watchguard_firebox/data_stream/log/fields/fields.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -608,6 +608,8 @@
608608
type: keyword
609609
- name: user_domain
610610
type: keyword
611+
- name: user_email
612+
type: keyword
611613
- name: user_name
612614
type: keyword
613615
- name: user_response_time

‎packages/watchguard_firebox/docs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -555,6 +555,7 @@ An example event for `log` looks as following:
555555
| watchguard_firebox.log.updated_role | | keyword |
556556
| watchguard_firebox.log.user_auth_protocol | | keyword |
557557
| watchguard_firebox.log.user_domain | | keyword |
558+
| watchguard_firebox.log.user_email | | keyword |
558559
| watchguard_firebox.log.user_name | | keyword |
559560
| watchguard_firebox.log.user_response_time | | date |
560561
| watchguard_firebox.log.user_type | | keyword |

‎packages/watchguard_firebox/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.1.4
22
name: watchguard_firebox
33
title: WatchGuard Firebox
4-
version: "1.1.0"
4+
version: "1.2.0"
55
description: Collect logs from WatchGuard Firebox with Elastic Agent.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)