Skip to content

Commit 1f20ccc

Browse files
mjwolfmjwolf
authored
Merge branch 'main' into cisco_asa_ip6
2 parents b026d83 + 7051042 commit 1f20ccc

File tree

53 files changed

+5121
-7194
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+5121
-7194
lines changed

‎packages/darktrace/changelog.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
# newer versions go on top
2+
- version: "2.0.0"
3+
changes:
4+
- description: Fix model defeat handling when nested conditions exist and so defeat ID can be non-numeric.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15552
7+
- description: '`darktrace.model_breach_alert.model.defeats.id` field type is changed from `long` to `keyword`.'
8+
type: breaking-change
9+
link: https://github.com/elastic/integrations/pull/15552
210
- version: "1.23.0"
311
changes:
412
- description: Update Kibana constraint to support 9.0.0.

‎packages/darktrace/data_stream/model_breach_alert/_dev/test/pipeline/test-model-breach-alert.log‎

Lines changed: 2 additions & 1 deletion
Large diffs are not rendered by default.

‎packages/darktrace/data_stream/model_breach_alert/_dev/test/pipeline/test-model-breach-alert.log-expected.json‎

Lines changed: 246 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2053,23 +2053,23 @@
20532053
},
20542054
"comparator": "matches",
20552055
"filtertype": "Connection hostname",
2056-
"id": 1
2056+
"id": "1"
20572057
},
20582058
{
20592059
"arguments": {
20602060
"value": "some.connection"
20612061
},
20622062
"comparator": "matches",
20632063
"filtertype": "Connection hostname",
2064-
"id": 2
2064+
"id": "2"
20652065
},
20662066
{
20672067
"arguments": {
20682068
"value": "another.connection"
20692069
},
20702070
"comparator": "matches",
20712071
"filtertype": "Connection hostname",
2072-
"id": 3
2072+
"id": "3"
20732073
}
20742074
],
20752075
"delay": 0,
@@ -2259,6 +2259,249 @@
22592259
"preserve_original_event",
22602260
"preserve_duplicate_custom_fields"
22612261
]
2262+
},
2263+
{
2264+
"@timestamp": "2024-12-10T06:49:49.000Z",
2265+
"ecs": {
2266+
"version": "8.11.0"
2267+
},
2268+
"related": {
2269+
"user": [
2270+
"System",
2271+
"[email protected]"
2272+
]
2273+
},
2274+
"host": {
2275+
"type": "desktop",
2276+
"id": "18390"
2277+
},
2278+
"rule": {
2279+
"author": [
2280+
"System"
2281+
],
2282+
"name": "Antigena::Network::Insider Threat::Antigena Internal Data Transfer Block",
2283+
"description": "A device has been blocked transferring large volumes of data internally.\n\nAction: Review the device's other alerts to see the activities the device has been conducting. Clear any active blocks if the alert was considered to be legitimate.",
2284+
"category": "Informational",
2285+
"uuid": "00000000-0000-0000-0000-000000000000",
2286+
"version": "17"
2287+
},
2288+
"event": {
2289+
"severity": 2,
2290+
"original": "{\"acknowledged\":{\"time\":1733838122000,\"username\":\"[email protected]\"},\"breachUrl\":\"https://redacted.local/#modelbreach/36725\",\"commentCount\":0,\"creationTime\":1733813400000,\"device\":{\"devicelabel\":\"test_device\",\"did\":18390,\"firstSeen\":1731062390000,\"generatedlabel\":true,\"lastSeen\":1736249138000,\"os\":\"Windows NT kernel\",\"sid\":-6,\"typelabel\":\"Desktop\",\"typename\":\"desktop\"},\"devicepercentscore\":44,\"devicescore\":0.439,\"did\":18390,\"model\":{\"actions\":{\"aianalyst\":{\"hypotheses\":[]},\"alert\":true,\"antigena\":{\"action\":\"automatic\",\"confirm\":false,\"duration\":3600,\"threshold\":\"20\"},\"breach\":true,\"model\":true,\"setPriority\":false,\"setTag\":false,\"setType\":false},\"active\":true,\"activeTimes\":{\"devices\":{},\"tags\":{},\"type\":\"exclusions\",\"version\":2},\"autoSuppress\":false,\"autoUpdatable\":true,\"autoUpdate\":true,\"behaviour\":\"decreasing\",\"category\":\"Informational\",\"compliance\":false,\"created\":{\"by\":\"System\"},\"defeats\":[[{\"arguments\":{\"value\":\"REDACTED_IP\"},\"comparator\":\"matches\",\"defeatID\":1,\"filtertype\":\"Destination IP\"},{\"arguments\":{\"value\":\"REDACTED_CIDR\"},\"comparator\":\"matches\",\"defeatID\":\"1-1\",\"filtertype\":\"Source IP\"},{\"arguments\":{\"value\":\"1150\"},\"comparator\":\"=\",\"defeatID\":\"1-2\",\"filtertype\":\"Destination port\"}]],\"delay\":0,\"description\":\"A device has been blocked transferring large volumes of data internally.\\n\\nAction: Review the device's other alerts to see the activities the device has been conducting. Clear any active blocks if the alert was considered to be legitimate.\",\"edited\":{\"by\":\"[email protected]\",\"userID\":17},\"interval\":3600,\"logic\":{\"data\":[{\"cid\":67318,\"weight\":1}],\"targetScore\":1,\"type\":\"weightedComponentList\",\"version\":1},\"mitre\":{\"tactics\":[\"defense-evasion\",\"exfiltration\"],\"techniques\":[\"T1030\",\"T1070.004\"]},\"modified\":\"2024-11-19 13:45:36\",\"name\":\"Antigena::Network::Insider Threat::Antigena Internal Data Transfer Block\",\"phid\":10256,\"pid\":90,\"priority\":2,\"sequenced\":false,\"sharedEndpoints\":false,\"tags\":[],\"throttle\":3600,\"uuid\":\"00000000-0000-0000-0000-000000000000\",\"version\":17},\"pbid\":36725,\"pbscore\":0.586,\"percentscore\":44,\"score\":0.439,\"time\":1733813389000,\"triggeredComponents\":[{\"cbid\":45710,\"chid\":77645,\"cid\":67318,\"interval\":3600,\"logic\":{\"data\":{\"left\":{\"left\":\"A\",\"operator\":\"AND\",\"right\":{\"left\":\"B\",\"operator\":\"AND\",\"right\":\"C\"}},\"operator\":\"OR\",\"right\":{\"left\":\"A\",\"operator\":\"AND\",\"right\":{\"left\":\"B\",\"operator\":\"AND\",\"right\":\"D\"}}},\"version\":\"v0.1\"},\"metric\":{\"label\":\"Model\",\"mlid\":234,\"name\":\"dtmodelbreach\"},\"size\":1,\"threshold\":0,\"time\":1733813388000,\"triggeredFilters\":[{\"arguments\":{\"value\":\"Unusual Activity / Internal Data Transfer\"},\"cfid\":340800,\"comparatorType\":\"matches\",\"filterType\":\"Message\",\"id\":\"A\",\"trigger\":{\"value\":\"Unusual Activity / Internal Data Transfer\"}},{\"arguments\":{\"value\":50},\"cfid\":340801,\"comparatorType\":\">\",\"filterType\":\"Strength of model breach\",\"id\":\"B\",\"trigger\":{\"value\":\"71\"}},{\"arguments\":{\"value\":16},\"cfid\":340802,\"comparatorType\":\"has tag\",\"filterType\":\"Tagged internal source\",\"id\":\"C\",\"trigger\":{\"tag\":{\"data\":{\"auto\":false,\"color\":92,\"description\":\"\",\"visibility\":\"Public\"},\"isReferenced\":true,\"name\":\"Antigena All\",\"restricted\":false,\"thid\":289,\"tid\":16},\"value\":\"16\"}},{\"arguments\":{},\"cfid\":340804,\"comparatorType\":\"display\",\"filterType\":\"Message\",\"id\":\"d1\",\"trigger\":{\"value\":\"Unusual Activity / Internal Data Transfer\"}}]}]}",
2291+
"risk_score": 0.439,
2292+
"risk_score_norm": 43.9,
2293+
"kind": "event",
2294+
"created": "2024-12-10T06:50:00.000Z",
2295+
"start": [
2296+
"2024-12-10T06:49:48.000Z"
2297+
],
2298+
"action": "automatic",
2299+
"type": [
2300+
"info"
2301+
],
2302+
"url": "https://redacted.local/#modelbreach/36725"
2303+
},
2304+
"darktrace": {
2305+
"model_breach_alert": {
2306+
"pb_score": 0.586,
2307+
"breach_url": {
2308+
"path": "/",
2309+
"fragment": "modelbreach/36725",
2310+
"original": "https://redacted.local/#modelbreach/36725",
2311+
"scheme": "https",
2312+
"domain": "redacted.local"
2313+
},
2314+
"is_acknowledged": false,
2315+
"acknowledged": {
2316+
"time": "2024-12-10T13:42:02.000Z",
2317+
"username": "[email protected]"
2318+
},
2319+
"creation_time": "2024-12-10T06:50:00.000Z",
2320+
"pbid": 36725,
2321+
"score": 0.439,
2322+
"time": "2024-12-10T06:49:49.000Z",
2323+
"comment": {
2324+
"count": 0
2325+
},
2326+
"model": {
2327+
"priority": 2,
2328+
"throttle": 3600,
2329+
"uuid": "00000000-0000-0000-0000-000000000000",
2330+
"version": 17,
2331+
"is_active": true,
2332+
"edited": {
2333+
"by": "[email protected]"
2334+
},
2335+
"active_times": {
2336+
"type": "exclusions",
2337+
"version": 2
2338+
},
2339+
"phid": 10256,
2340+
"is_auto_update": true,
2341+
"pid": 90,
2342+
"is_shared_endpoints": false,
2343+
"delay": 0,
2344+
"description": "A device has been blocked transferring large volumes of data internally.\n\nAction: Review the device's other alerts to see the activities the device has been conducting. Clear any active blocks if the alert was considered to be legitimate.",
2345+
"defeats": [
2346+
[
2347+
{
2348+
"id": "1",
2349+
"comparator": "matches",
2350+
"arguments": {
2351+
"value": "REDACTED_IP"
2352+
},
2353+
"filtertype": "Destination IP"
2354+
},
2355+
{
2356+
"id": "1-1",
2357+
"comparator": "matches",
2358+
"arguments": {
2359+
"value": "REDACTED_CIDR"
2360+
},
2361+
"filtertype": "Source IP"
2362+
},
2363+
{
2364+
"id": "1-2",
2365+
"comparator": "=",
2366+
"arguments": {
2367+
"value": "1150"
2368+
},
2369+
"filtertype": "Destination port"
2370+
}
2371+
]
2372+
],
2373+
"is_auto_suppress": false,
2374+
"is_sequenced": false,
2375+
"in_compliance_behavior_category": false,
2376+
"is_auto_updatable": true,
2377+
"modified": "2024-11-19T13:45:36.000Z",
2378+
"name": "Antigena::Network::Insider Threat::Antigena Internal Data Transfer Block",
2379+
"behaviour": "decreasing",
2380+
"category": "Informational",
2381+
"created": {
2382+
"by": "System"
2383+
},
2384+
"interval": 3600,
2385+
"logic": {
2386+
"data_weighted_component_list": [
2387+
{
2388+
"weight": 1,
2389+
"cid": 67318
2390+
}
2391+
],
2392+
"target_score": 1,
2393+
"type": "weightedComponentList",
2394+
"version": 1
2395+
},
2396+
"actions": {
2397+
"is_alerting": true,
2398+
"is_tag_set": false,
2399+
"is_type_set": false,
2400+
"antigena": {
2401+
"action": "automatic",
2402+
"duration": 3600,
2403+
"threshold": 20,
2404+
"is_confirm_by_human_operator": false
2405+
},
2406+
"model": true,
2407+
"is_priority_set": false,
2408+
"is_breach": true
2409+
}
2410+
},
2411+
"device_score": 0.439,
2412+
"device": {
2413+
"first_seen": "2024-11-08T10:39:50.000Z",
2414+
"type_label": "Desktop",
2415+
"type_name": "desktop",
2416+
"last_seen": "2025-01-07T11:25:38.000Z",
2417+
"sid": -6,
2418+
"did": 18390
2419+
},
2420+
"triggered_components": [
2421+
{
2422+
"triggered_filters": [
2423+
{
2424+
"cfid": 340800,
2425+
"comparator_type": "matches",
2426+
"filter_type": "Message",
2427+
"arguments": {
2428+
"value": "Unusual Activity / Internal Data Transfer"
2429+
},
2430+
"id": "A",
2431+
"trigger": {
2432+
"value": "Unusual Activity / Internal Data Transfer"
2433+
}
2434+
},
2435+
{
2436+
"cfid": 340801,
2437+
"comparator_type": ">",
2438+
"filter_type": "Strength of model breach",
2439+
"arguments": {
2440+
"value": 50
2441+
},
2442+
"id": "B",
2443+
"trigger": {
2444+
"value": "71"
2445+
}
2446+
},
2447+
{
2448+
"cfid": 340802,
2449+
"comparator_type": "has tag",
2450+
"filter_type": "Tagged internal source",
2451+
"arguments": {
2452+
"value": 16
2453+
},
2454+
"id": "C",
2455+
"trigger": {
2456+
"value": "16",
2457+
"tag": {
2458+
"data": {
2459+
"auto": false,
2460+
"color": 92,
2461+
"visibility": "Public"
2462+
},
2463+
"restricted": false,
2464+
"name": "Antigena All",
2465+
"thid": 289,
2466+
"is_referenced": true,
2467+
"tid": 16
2468+
}
2469+
}
2470+
},
2471+
{
2472+
"cfid": 340804,
2473+
"id": "d1",
2474+
"trigger": {
2475+
"value": "Unusual Activity / Internal Data Transfer"
2476+
},
2477+
"comparator_type": "display",
2478+
"filter_type": "Message"
2479+
}
2480+
],
2481+
"cbid": 45710,
2482+
"size": 1,
2483+
"metric": {
2484+
"name": "dtmodelbreach",
2485+
"mlid": 234,
2486+
"label": "Model"
2487+
},
2488+
"time": "2024-12-10T06:49:48.000Z",
2489+
"interval": 3600,
2490+
"threshold": 0,
2491+
"logic": {
2492+
"data": "{left={left=A, right={left=B, right=C, operator=AND}, operator=AND}, right={left=A, right={left=B, right=D, operator=AND}, operator=AND}, operator=OR}",
2493+
"version": "v0.1"
2494+
},
2495+
"chid": 77645,
2496+
"cid": 67318
2497+
}
2498+
]
2499+
}
2500+
},
2501+
"tags": [
2502+
"preserve_original_event",
2503+
"preserve_duplicate_custom_fields"
2504+
]
22622505
}
22632506
]
22642507
}

‎packages/darktrace/data_stream/model_breach_alert/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 34 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -669,14 +669,8 @@ processors:
669669
convert:
670670
field: _ingest._value.defeatID
671671
target_field: _ingest._value.id
672-
type: long
672+
type: string
673673
ignore_missing: true
674-
on_failure:
675-
- remove:
676-
field: _ingest._value.defeatID
677-
- append:
678-
field: error.message
679-
value: '{{{_ingest.on_failure_message}}}'
680674
- foreach:
681675
field: json.model.defeats
682676
if: ctx.json?.model?.defeats instanceof List
@@ -685,6 +679,39 @@ processors:
685679
remove:
686680
field: _ingest._value.defeatID
687681
ignore_missing: true
682+
- foreach:
683+
field: json.model.defeats
684+
if: ctx.json?.model?.defeats instanceof List
685+
ignore_failure: true
686+
processor:
687+
foreach:
688+
field: _ingest._value
689+
ignore_failure: true
690+
processor:
691+
convert:
692+
field: _ingest._value.defeatID
693+
target_field: _ingest._value.id
694+
type: string
695+
ignore_missing: true
696+
on_failure:
697+
- remove:
698+
field: _ingest._value.defeatID
699+
- append:
700+
field: error.message
701+
value: '{{{_ingest.on_failure_message}}}'
702+
- foreach:
703+
field: json.model.defeats
704+
if: ctx.json?.model?.defeats instanceof List
705+
ignore_failure: true
706+
processor:
707+
foreach:
708+
field: _ingest._value
709+
ignore_failure: true
710+
processor:
711+
remove:
712+
field: _ingest._value.defeatID
713+
ignore_missing: true
714+
688715
- rename:
689716
field: json.model.defeats
690717
target_field: darktrace.model_breach_alert.model.defeats

‎packages/darktrace/data_stream/model_breach_alert/fields/fields.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@
225225
type: keyword
226226
description: The filter the defeat is made from.
227227
- name: id
228-
type: long
228+
type: keyword
229229
description: A unique ID for the defeat.
230230
- name: delay
231231
type: long

‎packages/darktrace/docs/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1086,7 +1086,7 @@ An example event for `model_breach_alert` looks as following:
10861086
| darktrace.model_breach_alert.model.defeats.arguments.value | The value(s) that must match for the defeat to take effect. | keyword |
10871087
| darktrace.model_breach_alert.model.defeats.comparator | The comparator that the value is compared against the create the defeat. | keyword |
10881088
| darktrace.model_breach_alert.model.defeats.filtertype | The filter the defeat is made from. | keyword |
1089-
| darktrace.model_breach_alert.model.defeats.id | A unique ID for the defeat. | long |
1089+
| darktrace.model_breach_alert.model.defeats.id | A unique ID for the defeat. | keyword |
10901090
| darktrace.model_breach_alert.model.delay | Minimum delay in seconds after a positive-scoring component has fired before the overall model score is calculated. Only applicable in target score models. | long |
10911091
| darktrace.model_breach_alert.model.description | The optional description of the model. | keyword |
10921092
| darktrace.model_breach_alert.model.edited.by | Username that last edited the model. | keyword |

‎packages/darktrace/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.3"
22
name: darktrace
33
title: Darktrace
4-
version: "1.23.0"
4+
version: "2.0.0"
55
description: Collect logs from Darktrace with Elastic Agent.
66
type: integration
77
categories:

‎packages/m365_defender/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ services:
3232
- 8080
3333
volumes:
3434
- ./vulnerability-http-mock-config.yml:/config.yml
35+
- ./download-vulnerability.log.gz:/download-vulnerability.log.gz
3536
environment:
3637
PORT: 8080
3738
command:

‎packages/m365_defender/_dev/deploy/docker/download-vulnerability.log.gz‎

1.23 KB
Binary file not shown.

0 commit comments

Comments
 (0)