Skip to content

Commit 4b30a00

Browse files
navnit-elasticnavnit-elastic
authored
cisco_umbrella: add support for log schema version v13 (#15791)
test samples are taken from the official Cisco Umbrella documentation.
1 parent bea876f commit 4b30a00

17 files changed

+693
-14
lines changed

‎packages/cisco_umbrella/_dev/build/docs/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ This integration is for [Cisco Umbrella](https://docs.umbrella.com/). It include
88

99
### Compatibility
1010

11-
This integration supports the log schema version 8 and 9.
11+
This integration supports the log [schema version 13](https://docs.umbrella.com/umbrella-user-guide/docs/log-format-and-versioning#log-schema-versions).
1212

1313
## What do I need to use this integration?
1414

‎packages/cisco_umbrella/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.33.0"
3+
changes:
4+
- description: Add support for log schema version v13.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/15791
27
- version: "1.32.0"
38
changes:
49
- description: Update the Cisco Umbrella README to add compatibility information.

‎packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-auditlogs.log-expected.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -215,4 +215,4 @@
215215
}
216216
}
217217
]
218-
}
218+
}

‎packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-cloudfirewalllogs.log‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
2020-07-23 18:03:46,[211039844],Passive Monitor,CDFW Tunnel Device,OUTBOUND,1,84,172.17.3.4,,67.43.156.12,,ams1.edc,12,ALLOW
22
2020-07-23 18:03:46,[211039844],Passive Monitor,CDFW Tunnel Device,INBOUND,1,84,172.17.3.4,,67.43.156.12,,ams1.edc,12,BLOCK
3-
"2019-01-14 18:03:46","[211039844]","Passive Monitor", "CDFW Tunnel Device","OUTBOUND","1","84","172.17.3.4","","67.43.156.12", "","ams1.edc","12","ALLOW","google.com,apple.com","44,66"
3+
"2019-01-14 18:03:46","[211039844]","Passive Monitor", "CDFW Tunnel Device","OUTBOUND","1","84","172.17.3.4","","67.43.156.12", "","ams1.edc","12","ALLOW","google.com,apple.com","44,66"
4+
"2024-06-14 18:59:57","[211039844]","Passive Monitor", "CDFW Tunnel Device","OUTBOUND","1","84","172.17.3.4","60951","67.43.156.12","443","ams1.edc","12","ALLOW","google.com,apple.com","44,66","1718391597","1718391597","3","3","1108","755","39-42","","eu-central-2b","","","","","\[]","","","","2204063","67.43.156.12","TRUE"

‎packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-cloudfirewalllogs.log-expected.json‎

Lines changed: 112 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,117 @@
251251
"tags": [
252252
"preserve_original_event"
253253
]
254+
},
255+
{
256+
"@timestamp": "2024-06-14T18:59:57.000Z",
257+
"cisco": {
258+
"umbrella": {
259+
"casi_category_ids": "\\[]",
260+
"datacenter": "ams1.edc",
261+
"destination_lists_id": "44,66",
262+
"egress": "TRUE",
263+
"first_packet_timestamp": "2024-06-14T18:59:57.000Z",
264+
"fqdns": [
265+
"google.com",
266+
"apple.com"
267+
],
268+
"identities": [
269+
"Passive Monitor"
270+
],
271+
"identity_types": [
272+
"CDFW Tunnel Device"
273+
],
274+
"last_packet_timestamp": "2024-06-14T18:59:57.000Z",
275+
"origin_id": "[211039844]"
276+
}
277+
},
278+
"cloud": {
279+
"availability_zone": "eu-central-2b"
280+
},
281+
"destination": {
282+
"address": "67.43.156.12",
283+
"as": {
284+
"number": 35908
285+
},
286+
"bytes": 755,
287+
"geo": {
288+
"continent_name": "Asia",
289+
"country_iso_code": "BT",
290+
"country_name": "Bhutan",
291+
"location": {
292+
"lat": 27.5,
293+
"lon": 90.5
294+
}
295+
},
296+
"ip": "67.43.156.12",
297+
"packets": 3,
298+
"port": 443
299+
},
300+
"ecs": {
301+
"version": "8.11.0"
302+
},
303+
"event": {
304+
"action": "fw-connection-ALLOW",
305+
"category": [
306+
"network"
307+
],
308+
"id": "39-42",
309+
"kind": "event",
310+
"original": "\"2024-06-14 18:59:57\",\"[211039844]\",\"Passive Monitor\", \"CDFW Tunnel Device\",\"OUTBOUND\",\"1\",\"84\",\"172.17.3.4\",\"60951\",\"67.43.156.12\",\"443\",\"ams1.edc\",\"12\",\"ALLOW\",\"google.com,apple.com\",\"44,66\",\"1718391597\",\"1718391597\",\"3\",\"3\",\"1108\",\"755\",\"39-42\",\"\",\"eu-central-2b\",\"\",\"\",\"\",\"\",\"\\[]\",\"\",\"\",\"\",\"2204063\",\"67.43.156.12\",\"TRUE\"",
311+
"type": [
312+
"allowed",
313+
"connection"
314+
]
315+
},
316+
"log": {
317+
"file": {
318+
"path": "/test/path/cloudfirewalllogs"
319+
}
320+
},
321+
"network": {
322+
"bytes": 1863,
323+
"community_id": "1:7y0Rtnc087ycVA+d/fCa/8i5fTo=",
324+
"direction": "outbound",
325+
"name": [
326+
"Passive Monitor"
327+
],
328+
"packets": 6,
329+
"transport": "1"
330+
},
331+
"observer": {
332+
"product": "Umbrella",
333+
"type": "firewall",
334+
"vendor": "Cisco"
335+
},
336+
"organization": {
337+
"id": "2204063"
338+
},
339+
"related": {
340+
"hosts": [
341+
"google.com",
342+
"apple.com"
343+
],
344+
"ip": [
345+
"172.17.3.4",
346+
"67.43.156.12"
347+
]
348+
},
349+
"rule": {
350+
"id": "12"
351+
},
352+
"source": {
353+
"address": "172.17.3.4",
354+
"bytes": 1108,
355+
"ip": "172.17.3.4",
356+
"nat": {
357+
"ip": "67.43.156.12"
358+
},
359+
"packets": 3,
360+
"port": 60951
361+
},
362+
"tags": [
363+
"preserve_original_event"
364+
]
254365
}
255366
]
256-
}
367+
}

‎packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dlplogs.log‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
"2022-02-15 12:05:45","Real Time","f64dcc3f-50fa-410a-b8e1-589894276cee_17c81f85-34f7-4bc5-aa4c-155571f484f6","CRITICAL","Network1","","first.xlsx","Dropbox","http://google.com","BLOCK","rule-1","classification-2","classifier-2.1","text/html","48","abbd2352c3cfea8846871928bf99ca24dc3a6f162170926649381a6d968869ab", "Confidential"
1+
"2022-02-15 12:05:45","Real Time","f64dcc3f-50fa-410a-b8e1-589894276cee_17c81f85-34f7-4bc5-aa4c-155571f484f6","CRITICAL","Network1","","first.xlsx","Dropbox","http://google.com","BLOCK","rule-1","classification-2","classifier-2.1","text/html","48","abbd2352c3cfea8846871928bf99ca24dc3a6f162170926649381a6d968869ab", "Confidential"
2+
"2022-02-15 12:05:45","Real Time","f64dcc3f-50fa-410a-b8e1-589894276cee_17c81f85-34f7-4bc5-aa4c-155571f484f6","CRITICAL","Network1","","first.xlsx","Dropbox","http://google.com","BLOCK","rule-1","classification-2","classifier-2.1","text/html","48","abbd2352c3cfea8846871928bf99ca24dc3a6f162170926649381a6d968869ab", "Confidential","","","dlpprivateresource","","https","67.43.156.12","443","8247177"

‎packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dlplogs.log-expected.json‎

Lines changed: 96 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
}
4545
},
4646
"network": {
47-
"application": "Dropbox",
47+
"application": "dropbox",
4848
"name": "Network1"
4949
},
5050
"observer": {
@@ -69,6 +69,100 @@
6969
"path": "",
7070
"scheme": "http"
7171
}
72+
},
73+
{
74+
"@timestamp": "2022-02-15T12:05:45.000Z",
75+
"cisco": {
76+
"umbrella": {
77+
"data_classification": "classification-2",
78+
"data_identifier": "classifier-2.1",
79+
"file_label": "Confidential",
80+
"private_resource_name": "dlpprivateresource",
81+
"severity": "CRITICAL"
82+
}
83+
},
84+
"destination": {
85+
"as": {
86+
"number": 35908
87+
},
88+
"geo": {
89+
"continent_name": "Asia",
90+
"country_iso_code": "BT",
91+
"country_name": "Bhutan",
92+
"location": {
93+
"lat": 27.5,
94+
"lon": 90.5
95+
}
96+
},
97+
"ip": "67.43.156.12",
98+
"port": 443
99+
},
100+
"ecs": {
101+
"version": "8.11.0"
102+
},
103+
"event": {
104+
"action": "dlp-BLOCK",
105+
"category": [
106+
"network",
107+
"file"
108+
],
109+
"id": "f64dcc3f-50fa-410a-b8e1-589894276cee_17c81f85-34f7-4bc5-aa4c-155571f484f6",
110+
"kind": "event",
111+
"original": "\"2022-02-15 12:05:45\",\"Real Time\",\"f64dcc3f-50fa-410a-b8e1-589894276cee_17c81f85-34f7-4bc5-aa4c-155571f484f6\",\"CRITICAL\",\"Network1\",\"\",\"first.xlsx\",\"Dropbox\",\"http://google.com\",\"BLOCK\",\"rule-1\",\"classification-2\",\"classifier-2.1\",\"text/html\",\"48\",\"abbd2352c3cfea8846871928bf99ca24dc3a6f162170926649381a6d968869ab\", \"Confidential\",\"\",\"\",\"dlpprivateresource\",\"\",\"https\",\"67.43.156.12\",\"443\",\"8247177\"",
112+
"provider": "Real Time",
113+
"severity": 4,
114+
"type": [
115+
"denied",
116+
"connection",
117+
"info"
118+
]
119+
},
120+
"file": {
121+
"hash": {
122+
"sha256": "abbd2352c3cfea8846871928bf99ca24dc3a6f162170926649381a6d968869ab"
123+
},
124+
"mime_type": "text/html",
125+
"name": "first.xlsx",
126+
"size": 48
127+
},
128+
"log": {
129+
"file": {
130+
"path": "/test/path/dlplogs"
131+
}
132+
},
133+
"network": {
134+
"application": "dropbox",
135+
"name": "Network1",
136+
"protocol": "https"
137+
},
138+
"observer": {
139+
"product": "Umbrella",
140+
"type": "dlp",
141+
"vendor": "Cisco"
142+
},
143+
"organization": {
144+
"id": "8247177"
145+
},
146+
"related": {
147+
"hash": [
148+
"abbd2352c3cfea8846871928bf99ca24dc3a6f162170926649381a6d968869ab"
149+
],
150+
"ip": [
151+
"67.43.156.12"
152+
]
153+
},
154+
"rule": {
155+
"name": "rule-1"
156+
},
157+
"tags": [
158+
"preserve_original_event"
159+
],
160+
"url": {
161+
"domain": "google.com",
162+
"original": "http://google.com",
163+
"path": "",
164+
"scheme": "http"
165+
}
72166
}
73167
]
74-
}
168+
}

‎packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dnslogs.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,4 @@
1313
"2023-05-05 12:50:00","Ca_redacted, Ch_redacted ([email protected])","Ca_redacted, Ch_redacted ([email protected]),5CG0310TQZ","192.168.1.79","89.160.20.128","Allowed","1 (A)","NOERROR","presence.gcc.teams.microsoft.com.","Software/Technology,Business Services,Allow List,Infrastructure and Content Delivery Networks,Online Meetings,Application,Cloud and Data Centers","AD Users","AD Users,Anyconnect Roaming Client","Allow List"
1414
"2023-05-05 12:40:01","G_redacted, Er_redacted R ([email protected])","G_redacted, Er_redacted R ([email protected]),Mega Corp,MXL952303K","10.245.149.68","81.2.69.144","Allowed","1 (A)","NOERROR","outlook.office365.com.","Software/Technology,Webmail,Business Services,Allow List,Organizational Email,Application,Web-based Email,Online Document Sharing and Collaboration","AD Users","AD Users,Networks,Anyconnect Roaming Client","Allow List"
1515
"2023-05-05 12:40:01","LastName, Tiredacted M (Ti) ([email protected])","LastName, Tiredacted M (Ti) ([email protected]),5CG0310TPJ","192.168.4.66","81.2.69.192","Allowed","1 (A)","NOERROR","outlook.office365.com.","Software/Technology,Webmail,Business Services,Allow List,Organizational Email,Application,Web-based Email,Online Document Sharing and Collaboration","AD Users","AD Users,Anyconnect Roaming Client","Allow List"
16+
"2024-09-11 18:46:00","Active Directory User ([[email protected]](mailto:[email protected]))","Active Directory User ([[email protected]](mailto:[email protected])),WIN11-SNG01-Example","192.168.4.66","81.2.69.192","Blocked","1 (A)","NOERROR","domain-visited.com.","Chat,Social Networking","AD Users","AD Users,Anyconnect Roaming Client","Social Networking","506165","","8234970"

‎packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dnslogs.log-expected.json‎

Lines changed: 99 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1353,6 +1353,104 @@
13531353
"id": "[email protected]",
13541354
"name": "Tiredacted.LastName"
13551355
}
1356+
},
1357+
{
1358+
"@timestamp": "2024-09-11T18:46:00.000Z",
1359+
"cisco": {
1360+
"umbrella": {
1361+
"blocked_categories": [
1362+
"Social Networking"
1363+
],
1364+
"categories": [
1365+
"Chat",
1366+
"Social Networking"
1367+
],
1368+
"identities": [
1369+
"Active Directory User ([[email protected]](mailto:[email protected]))",
1370+
"WIN11-SNG01-Example"
1371+
],
1372+
"identity": "Active Directory User ([[email protected]](mailto:[email protected]))",
1373+
"identity_types": [
1374+
"AD Users",
1375+
"Anyconnect Roaming Client"
1376+
],
1377+
"policy_identity_type": "AD Users"
1378+
}
1379+
},
1380+
"dns": {
1381+
"question": {
1382+
"name": "domain-visited.com",
1383+
"registered_domain": "domain-visited.com",
1384+
"top_level_domain": "com",
1385+
"type": "1 (A)"
1386+
},
1387+
"response_code": "NOERROR",
1388+
"type": "query"
1389+
},
1390+
"ecs": {
1391+
"version": "8.11.0"
1392+
},
1393+
"event": {
1394+
"action": "dns-request-Blocked",
1395+
"category": [
1396+
"network"
1397+
],
1398+
"kind": "event",
1399+
"original": "\"2024-09-11 18:46:00\",\"Active Directory User ([[email protected]](mailto:[email protected]))\",\"Active Directory User ([[email protected]](mailto:[email protected])),WIN11-SNG01-Example\",\"192.168.4.66\",\"81.2.69.192\",\"Blocked\",\"1 (A)\",\"NOERROR\",\"domain-visited.com.\",\"Chat,Social Networking\",\"AD Users\",\"AD Users,Anyconnect Roaming Client\",\"Social Networking\",\"506165\",\"\",\"8234970\"",
1400+
"type": [
1401+
"denied",
1402+
"connection"
1403+
]
1404+
},
1405+
"host": {
1406+
"name": "win11-sng01-example"
1407+
},
1408+
"log": {
1409+
"file": {
1410+
"path": "/test/path/dnslogs"
1411+
}
1412+
},
1413+
"observer": {
1414+
"product": "Umbrella",
1415+
"type": "dns",
1416+
"vendor": "Cisco"
1417+
},
1418+
"organization": {
1419+
"id": "8234970"
1420+
},
1421+
"related": {
1422+
"hosts": [
1423+
"win11-sng01-example",
1424+
"domain-visited.com"
1425+
],
1426+
"ip": [
1427+
"192.168.4.66",
1428+
"81.2.69.192"
1429+
],
1430+
"user": [
1431+
"adusername"
1432+
]
1433+
},
1434+
"rule": {
1435+
"id": "506165"
1436+
},
1437+
"source": {
1438+
"address": "192.168.4.66",
1439+
"ip": "192.168.4.66",
1440+
"nat": {
1441+
"ip": "81.2.69.192"
1442+
}
1443+
},
1444+
"tags": [
1445+
"preserve_original_event"
1446+
],
1447+
"user": {
1448+
"domain": "example.net",
1449+
"email": "[email protected]",
1450+
"full_name": "Active Directory User",
1451+
"id": "[email protected]",
1452+
"name": "adusername"
1453+
}
13561454
}
13571455
]
1358-
}
1456+
}

‎packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-intrusionlogs.log‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
"2022-04-12 16:14:09","Firewall Tunnel 1","Network Tunnels","1","16606","SERVER-ORACLE BEA WebLogic Server Plug-ins Certificate overflow attempt","1323","HIGH","Attempted User Privilege Gain","cve-2009-1016","TCP","12345","172.17.3.4","33010","67.43.156.12","443","Would Block"
1+
"2022-04-12 16:14:09","Firewall Tunnel 1","Network Tunnels","1","16606","SERVER-ORACLE BEA WebLogic Server Plug-ins Certificate overflow attempt","1323","HIGH","Attempted User Privilege Gain","cve-2009-1016","TCP","12345","172.17.3.4","33010","67.43.156.12","443","Would Block"
2+
"2024-09-11 23:17:13","Firewall Tunnel Name","Network Tunnels","1","16606","SERVER-ORACLE BEA WebLogic Server Plug-ins Certificate overflow attempt","50516","HIGH","Attempted User Privilege Gain","cve-2009-1016","TCP","12345","172.17.3.4","80","67.43.156.12","40762","Would Block","IDS","50516","S2C","21171","PROFILE","eu-central-2b","","\[]","DEN1","8151514","67.43.156.12","TRUE","FTD","12321321312",""

0 commit comments

Comments
 (0)