cisco_umbrella: add support for log schema version v13

[navnit-elastic]

Proposed commit message

cisco_umbrella: add support for log schema version v13

test samples are taken from the official Cisco Umbrella documentation.

Note

Documentation for log schema version v13: https://docs.umbrella.com/umbrella-user-guide/docs/log-format-and-versioning
The DNS logs appear to be ingesting as expected. We couldn't test the other logs due to the unavailability of logs in the instance. I'll raise an issue to expand tests coverage for the v13 logs to keep a note of this.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Pipeline test:

--- Test results for package: cisco_umbrella - START ---
╭────────────────┬─────────────┬───────────┬────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE        │ DATA STREAM │ TEST TYPE │ TEST NAME                                                      │ RESULT │ TIME ELAPSED │
├────────────────┼─────────────┼───────────┼────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ cisco_umbrella │ log         │ pipeline  │ (ingest pipeline warnings test-umbrella-auditlogs.log)         │ PASS   │ 365.699224ms │
│ cisco_umbrella │ log         │ pipeline  │ (ingest pipeline warnings test-umbrella-cloudfirewalllogs.log) │ PASS   │ 367.082079ms │
│ cisco_umbrella │ log         │ pipeline  │ (ingest pipeline warnings test-umbrella-dlplogs.log)           │ PASS   │ 327.656807ms │
│ cisco_umbrella │ log         │ pipeline  │ (ingest pipeline warnings test-umbrella-dnslogs.log)           │ PASS   │ 342.407749ms │
│ cisco_umbrella │ log         │ pipeline  │ (ingest pipeline warnings test-umbrella-intrusionlogs.log)     │ PASS   │ 322.970298ms │
│ cisco_umbrella │ log         │ pipeline  │ (ingest pipeline warnings test-umbrella-iplogs.log)            │ PASS   │ 320.470532ms │
│ cisco_umbrella │ log         │ pipeline  │ (ingest pipeline warnings test-umbrella-proxylogs.log)         │ PASS   │ 327.045787ms │
│ cisco_umbrella │ log         │ pipeline  │ test-umbrella-auditlogs.log                                    │ PASS   │ 161.362581ms │
│ cisco_umbrella │ log         │ pipeline  │ test-umbrella-cloudfirewalllogs.log                            │ PASS   │ 159.968892ms │
│ cisco_umbrella │ log         │ pipeline  │ test-umbrella-dlplogs.log                                      │ PASS   │ 102.167404ms │
│ cisco_umbrella │ log         │ pipeline  │ test-umbrella-dnslogs.log                                      │ PASS   │ 368.592677ms │
│ cisco_umbrella │ log         │ pipeline  │ test-umbrella-intrusionlogs.log                                │ PASS   │ 105.917061ms │
│ cisco_umbrella │ log         │ pipeline  │ test-umbrella-iplogs.log                                       │ PASS   │   92.70967ms │
│ cisco_umbrella │ log         │ pipeline  │ test-umbrella-proxylogs.log                                    │ PASS   │ 525.044848ms │
╰────────────────┴─────────────┴───────────┴────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: cisco_umbrella - END   ---
Done

Related issues

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[navnit-elastic]

Normalizing network.application field to lowercase as per ECS recommendation.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

Can you provide links to the specific log examples that you used?

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 979a778

History

• 💚 Build #33340 succeeded 7aecb79
• 💚 Build #33335 succeeded e6778c0

cc @navnit-elastic

[elastic-vault-github-plugin-prod]

Package cisco_umbrella - 1.33.0 containing this change is available at https://epr.elastic.co/package/cisco_umbrella/1.33.0/