Skip to content

Commit cd9bc7b

Browse files
efd6efd6
authored
cisa_kevs: migrate input to CEL (#14804)
1 parent 62dc6b0 commit cd9bc7b

File tree

11 files changed

+155
-70
lines changed

11 files changed

+155
-70
lines changed

‎packages/cisa_kevs/_dev/build/docs/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ from logs-nessus.vulnerability*
3737
| limit 10
3838
```
3939

40+
## Upgrading to v1.7.0+
41+
42+
If upgrading from a version of the package before v1.7.0, you will need to re-enter your configuration details and re-enable the package.
43+
4044
## Logs
4145

4246
### Vulnerabilities

‎packages/cisa_kevs/_dev/deploy/docker/files/config.yml‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,50 @@ rules:
55
Content-Type: "application/json"
66
responses:
77
- status_code: 200
8-
body: "{\n \"title\": \"CISA Catalog of Known Exploited Vulnerabilities\",\n \"catalogVersion\": \"2024.02.16\",\n \"dateReleased\": \"2024-02-16T19:54:05.3915Z\",\n \"count\": 1081,\n \"vulnerabilities\": [\n {\n \"cveID\":\"CVE-2020-3259\",\"vendorProject\":\"Cisco\",\"product\":\"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)\",\"vulnerabilityName\":\"Cisco ASA and FTD Information Disclosure Vulnerability\",\"dateAdded\":\"2024-02-15\",\"shortDescription\":\"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.\",\"requiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"dueDate\":\"2024-03-07\",\"knownRansomwareCampaignUse\":\"Known\",\"notes\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB\"\n },\n {\n \"cveID\":\"CVE-2024-21410\",\"vendorProject\":\"Microsoft\",\"product\":\"Exchange Server\",\"vulnerabilityName\":\"Microsoft Exchange Server Privilege Escalation Vulnerability\",\"dateAdded\":\"2024-02-15\",\"shortDescription\":\"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.\",\"requiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"dueDate\":\"2024-03-07\",\"knownRansomwareCampaignUse\":\"Unknown\",\"notes\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410\"\n },\n { \n \"cveID\":\"CVE-2024-1709\",\"vendorProject\":\"ConnectWise\",\"product\":\"ScreenConnect\",\"vulnerabilityName\":\"ConnectWise ScreenConnect Authentication Bypass Vulnerability\",\"dateAdded\":\"2024-02-22\",\"shortDescription\":\"ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.\",\"requiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"dueDate\":\"2024-02-29\",\"knownRansomwareCampaignUse\":\"Known\",\"notes\":\"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8\"\n }\n ]\n}"
8+
body: |-
9+
{{ minify_json `
10+
{
11+
"title": "CISA Catalog of Known Exploited Vulnerabilities",
12+
"catalogVersion": "2024.02.16",
13+
"dateReleased": "2024-02-16T19:54:05.3915Z",
14+
"count": 1081,
15+
"vulnerabilities": [
16+
{
17+
"cveID": "CVE-2020-3259",
18+
"vendorProject": "Cisco",
19+
"product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
20+
"vulnerabilityName": "Cisco ASA and FTD Information Disclosure Vulnerability",
21+
"dateAdded": "2024-02-15",
22+
"shortDescription": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.",
23+
"requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
24+
"dueDate": "2024-03-07",
25+
"knownRansomwareCampaignUse": "Known",
26+
"notes": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB"
27+
},
28+
{
29+
"cveID": "CVE-2024-21410",
30+
"vendorProject": "Microsoft",
31+
"product": "Exchange Server",
32+
"vulnerabilityName": "Microsoft Exchange Server Privilege Escalation Vulnerability",
33+
"dateAdded": "2024-02-15",
34+
"shortDescription": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.",
35+
"requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
36+
"dueDate": "2024-03-07",
37+
"knownRansomwareCampaignUse": "Unknown",
38+
"notes": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410"
39+
},
40+
{
41+
"cveID": "CVE-2024-1709",
42+
"vendorProject": "ConnectWise",
43+
"product": "ScreenConnect",
44+
"vulnerabilityName": "ConnectWise ScreenConnect Authentication Bypass Vulnerability",
45+
"dateAdded": "2024-02-22",
46+
"shortDescription": "ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.",
47+
"requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
48+
"dueDate": "2024-02-29",
49+
"knownRansomwareCampaignUse": "Known",
50+
"notes": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"
51+
}
52+
]
53+
}
54+
`}}

‎packages/cisa_kevs/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.7.0"
3+
changes:
4+
- description: Migrate data streams to the CEL input.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/14804
27
- version: "1.6.0"
38
changes:
49
- description: Add 'Security Solution' tag in the dashboard.

‎packages/cisa_kevs/data_stream/vulnerability/_dev/test/system/test-default-config.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
1-
input: httpjson
1+
input: cel
22
service: cisakev
33
data_stream:
44
vars:
55
url: http://{{Hostname}}:{{Port}}/sites/default/files/feeds/known_exploited_vulnerabilities.json
66
preserve_original_event: true
77
enable_request_tracer: true
8+
assert:
9+
hit_count: 3

‎packages/cisa_kevs/data_stream/vulnerability/agent/stream/cel.yml.hbs‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
config_version: "2"
2+
interval: {{interval}}
3+
{{#if enable_request_tracer}}
4+
resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson"
5+
resource.tracer.maxbackups: 5
6+
{{/if}}
7+
8+
{{#if url}}
9+
resource.url: {{url}}
10+
{{/if}}
11+
{{#if proxy_url }}
12+
resource.proxy_url: {{proxy_url}}
13+
{{/if}}
14+
{{#if ssl}}
15+
resource.ssl: {{ssl}}
16+
{{/if}}
17+
{{#if http_client_timeout}}
18+
resource.timeout: {{http_client_timeout}}
19+
{{/if}}
20+
redact:
21+
fields: ~
22+
program: |-
23+
get_request(state.url).with(
24+
{
25+
"Header": {
26+
"Content-Type": ["application/json"],
27+
},
28+
}
29+
).do_request().as(resp, resp.StatusCode == 200 ?
30+
dyn({
31+
"events": bytes(resp.Body).decode_json().vulnerabilities.map(v,
32+
{"message": v.encode_json()}
33+
)
34+
})
35+
:
36+
dyn({
37+
"events": {
38+
"error": {
39+
"code": string(resp.StatusCode),
40+
"id": string(resp.Status),
41+
"message": "GET: "+(
42+
size(resp.Body) != 0 ?
43+
string(resp.Body)
44+
:
45+
string(resp.Status) + ' (' + string(resp.StatusCode) + ')'
46+
),
47+
},
48+
},
49+
})
50+
)
51+
tags:
52+
{{#if preserve_original_event}}
53+
- preserve_original_event
54+
{{/if}}
55+
{{#each tags as |tag i|}}
56+
- {{tag}}
57+
{{/each}}
58+
{{#contains "forwarded" tags}}
59+
publisher_pipeline.disable_host: true
60+
{{/contains}}
61+
{{#if processors}}
62+
processors:
63+
{{processors}}
64+
{{/if}}

‎packages/cisa_kevs/data_stream/vulnerability/agent/stream/httpjson.yml.hbs‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎packages/cisa_kevs/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ processors:
77
- set:
88
field: ecs.version
99
value: '8.11.0'
10+
- fail:
11+
tag: data_collection_error
12+
if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null
13+
message: error message set and no data to process.
1014
- set:
1115
field: event.kind
1216
value: enrichment

‎packages/cisa_kevs/data_stream/vulnerability/manifest.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
title: "CISA Known Exploited Vulnerabilities List"
22
type: logs
33
streams:
4-
- input: httpjson
4+
- input: cel
55
vars:
66
- name: url
77
type: text
@@ -65,6 +65,7 @@ streams:
6565
description: >
6666
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
6767
68-
template_path: httpjson.yml.hbs
68+
template_path: cel.yml.hbs
6969
title: CISA KEV Catalog logs
7070
description: Collect CISA Known Exploited Vulnerability logs
71+
enabled: false

‎packages/cisa_kevs/data_stream/vulnerability/sample_event.json‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"@timestamp": "2024-02-15T00:00:00.000Z",
33
"agent": {
4-
"ephemeral_id": "39957f93-aff4-4e3f-84f0-66d18441ccd6",
5-
"id": "7edf8be5-ad5d-4c57-a6bd-b86bddc66601",
6-
"name": "docker-fleet-agent",
4+
"ephemeral_id": "fc07fa12-f549-40b8-b71a-d49f02d4941d",
5+
"id": "5f9e8c36-28d7-4df6-bdeb-68a9e24bfdc0",
6+
"name": "elastic-agent-37763",
77
"type": "filebeat",
8-
"version": "8.12.2"
8+
"version": "8.13.0"
99
},
1010
"cisa_kev": {
1111
"vulnerability": {
@@ -21,33 +21,32 @@
2121
},
2222
"data_stream": {
2323
"dataset": "cisa_kevs.vulnerability",
24-
"namespace": "ep",
24+
"namespace": "77864",
2525
"type": "logs"
2626
},
2727
"ecs": {
2828
"version": "8.11.0"
2929
},
3030
"elastic_agent": {
31-
"id": "7edf8be5-ad5d-4c57-a6bd-b86bddc66601",
31+
"id": "5f9e8c36-28d7-4df6-bdeb-68a9e24bfdc0",
3232
"snapshot": false,
33-
"version": "8.12.2"
33+
"version": "8.13.0"
3434
},
3535
"event": {
3636
"agent_id_status": "verified",
3737
"category": [
3838
"vulnerability"
3939
],
40-
"created": "2024-03-13T01:01:09.893Z",
4140
"dataset": "cisa_kevs.vulnerability",
42-
"ingested": "2024-03-13T01:01:21Z",
41+
"ingested": "2025-08-05T05:37:31Z",
4342
"kind": "enrichment",
4443
"original": "{\"cveID\":\"CVE-2020-3259\",\"dateAdded\":\"2024-02-15\",\"dueDate\":\"2024-03-07\",\"knownRansomwareCampaignUse\":\"Known\",\"notes\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB\",\"product\":\"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)\",\"requiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"shortDescription\":\"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.\",\"vendorProject\":\"Cisco\",\"vulnerabilityName\":\"Cisco ASA and FTD Information Disclosure Vulnerability\"}",
4544
"type": [
4645
"info"
4746
]
4847
},
4948
"input": {
50-
"type": "httpjson"
49+
"type": "cel"
5150
},
5251
"tags": [
5352
"preserve_original_event",
@@ -58,4 +57,4 @@
5857
"description": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.",
5958
"id": "CVE-2020-3259"
6059
}
61-
}
60+
}

‎packages/cisa_kevs/docs/README.md‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ from logs-nessus.vulnerability*
3737
| limit 10
3838
```
3939

40+
## Upgrading to v1.7.0+
41+
42+
If upgrading from a version of the package before v1.7.0, you will need to re-enter your configuration details and re-enable the package.
43+
4044
## Logs
4145

4246
### Vulnerabilities
@@ -49,11 +53,11 @@ An example event for `vulnerability` looks as following:
4953
{
5054
"@timestamp": "2024-02-15T00:00:00.000Z",
5155
"agent": {
52-
"ephemeral_id": "39957f93-aff4-4e3f-84f0-66d18441ccd6",
53-
"id": "7edf8be5-ad5d-4c57-a6bd-b86bddc66601",
54-
"name": "docker-fleet-agent",
56+
"ephemeral_id": "fc07fa12-f549-40b8-b71a-d49f02d4941d",
57+
"id": "5f9e8c36-28d7-4df6-bdeb-68a9e24bfdc0",
58+
"name": "elastic-agent-37763",
5559
"type": "filebeat",
56-
"version": "8.12.2"
60+
"version": "8.13.0"
5761
},
5862
"cisa_kev": {
5963
"vulnerability": {
@@ -69,33 +73,32 @@ An example event for `vulnerability` looks as following:
6973
},
7074
"data_stream": {
7175
"dataset": "cisa_kevs.vulnerability",
72-
"namespace": "ep",
76+
"namespace": "77864",
7377
"type": "logs"
7478
},
7579
"ecs": {
7680
"version": "8.11.0"
7781
},
7882
"elastic_agent": {
79-
"id": "7edf8be5-ad5d-4c57-a6bd-b86bddc66601",
83+
"id": "5f9e8c36-28d7-4df6-bdeb-68a9e24bfdc0",
8084
"snapshot": false,
81-
"version": "8.12.2"
85+
"version": "8.13.0"
8286
},
8387
"event": {
8488
"agent_id_status": "verified",
8589
"category": [
8690
"vulnerability"
8791
],
88-
"created": "2024-03-13T01:01:09.893Z",
8992
"dataset": "cisa_kevs.vulnerability",
90-
"ingested": "2024-03-13T01:01:21Z",
93+
"ingested": "2025-08-05T05:37:31Z",
9194
"kind": "enrichment",
9295
"original": "{\"cveID\":\"CVE-2020-3259\",\"dateAdded\":\"2024-02-15\",\"dueDate\":\"2024-03-07\",\"knownRansomwareCampaignUse\":\"Known\",\"notes\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB\",\"product\":\"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)\",\"requiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"shortDescription\":\"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.\",\"vendorProject\":\"Cisco\",\"vulnerabilityName\":\"Cisco ASA and FTD Information Disclosure Vulnerability\"}",
9396
"type": [
9497
"info"
9598
]
9699
},
97100
"input": {
98-
"type": "httpjson"
101+
"type": "cel"
99102
},
100103
"tags": [
101104
"preserve_original_event",

0 commit comments

Comments
 (0)