diff --git a/packages/azure/changelog.yml b/packages/azure/changelog.yml index 1b452d0efdd..61276789faa 100644 --- a/packages/azure/changelog.yml +++ b/packages/azure/changelog.yml @@ -1,3 +1,8 @@ +- version: "1.37.2" + changes: + - description: Add ECS event categorization fields to the graphactivitylogs data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/20276 - version: "1.37.1" changes: - description: Reduce degraded documents in azure.auditlogs by raising the keyword `ignore_above` limit to `8191` on `result_description`, `result_reason`, `additional_details.value`, and `modified_properties` leaf fields; fix the ingest pipeline to normalize the top-level `resultDescription` field to snake_case so it is correctly mapped; declare the missing `properties.result_description` field mapping as well. diff --git a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json index d8b1508be2e..b89a98124ff 100644 --- a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json +++ b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json @@ -70,9 +70,13 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 462680000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"durationMs\":462680,\"location\":\"West Europe\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e12-268a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe56789-a848-4c93-9d2c-5675972aejk9\",\"durationMs\":462680,\"identityProvider\":\"https://sts.windows.net/a140785b-418d-4344-a4ec-8e9648919gdb/\",\"ipAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"location\":\"West Europe\",\"operationId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"requestId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/organization/a140785b-418d-4344-a4ec-8e9648919gdb?$select=Id,DisplayName,CreatedDateTime,ReplicationScope,Country,CountryLetterCode,DataBoundary\",\"responseSizeBytes\":364,\"responseStatusCode\":200,\"roles\":\"Organization.Read.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5066-92g3-4b3dfbav50f0\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"a140785b-418d-4344-a4ec-8e9648919gdb\",\"timeGenerated\":\"2024-03-07T11:47:00.6442361Z\",\"tokenIssuedAt\":\"2024-03-07T11:42:00Z\",\"userAgent\":\"python-requests/2.27.1\",\"userId\":null,\"wids\":\"1997b4d3-0g8d-90cb-bhj8-d89n3121e90\"},\"resourceId\":\"/TENANTS/A140785B-418D-4344-A4EC-8E9648919GDB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"a140785b-418d-4344-a4ec-8e9648919gdb\",\"time\":\"2024-03-07T11:47:00.6442361Z\"}", + "outcome": "success", "type": [ "access" ] @@ -215,9 +219,13 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 453011000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"durationMs\":453011,\"location\":\"Germany West Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e12-268a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe56790-a848-4c83-9d2c-5675972aejk9\",\"durationMs\":453011,\"identityProvider\":\"https://sts.windows.net/aa30985b-427d-4434-b4dc-8f9040719adb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"Germany West Central\",\"operationId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"requestId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/me/photos/96x96/$value\",\"responseSizeBytes\":294,\"responseStatusCode\":404,\"roles\":null,\"scopes\":\"email openid Organization.Read.All Policy.ReadWrite.ApplicationConfiguration profile User.Read\",\"servicePrincipalId\":null,\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"aa30985b-427d-4434-b4dc-8f9040719adb\",\"timeGenerated\":\"2024-03-07T10:35:31.9597832Z\",\"tokenIssuedAt\":\"2024-03-07T10:30:30Z\",\"userAgent\":\"\",\"userId\":\"b37ec517-0a34-4266-b627-f7bb0d679d70\",\"wids\":\"1997b4d3-0g8d-90cb-bhj5-d80n3122e98 1997b4d3-0f8d-76cb-bhj5-d80n3122e98\"},\"resourceId\":\"/TENANTS/AA30985B-427D-4434-B4DC-8F9040719ADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"404\",\"tenantId\":\"aa30985b-427d-4434-b4dc-8f9040719adb\",\"time\":\"2024-03-07T10:35:31.9597832Z\"}", + "outcome": "failure", "type": [ "access" ] @@ -357,9 +365,13 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 16688471000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.144\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"durationMs\":16688471,\"location\":\"UK South\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"beta\",\"properties\":{\"apiVersion\":\"beta\",\"appId\":\"a5a68e12-268a-3c91-a5f2-b9254e67hb28\",\"atContent\":\"\",\"clientAuthMethod\":\"0\",\"clientRequestId\":\"2fe56789-a848-4c93-9s2c-5675972aghk9\",\"durationMs\":16688471,\"identityProvider\":null,\"ipAddress\":\"81.2.69.144\",\"location\":\"UK South\",\"operationId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"requestId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/beta//users/7ef3c2ad-d52l-4a89-8cf9-c30178181027/photos/48x48/$value\",\"responseSizeBytes\":0,\"responseStatusCode\":404,\"roles\":null,\"scopes\":\"AdministrativeUnit.ReadWrite.All AuditLog.Read.All Directory.AccessAsUser.All Directory.Write.Restricted email openid Organization.Read.All Policy.ReadWrite.Authorization profile User.EnableDisableAccount.All User.ReadWrite.All\",\"servicePrincipalId\":null,\"signInActivityId\":\"signin_ActivityId\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"timeGenerated\":\"2024-03-07T16:42:22.84914Z\",\"tokenIssuedAt\":\"2024-03-07T16:37:20Z\",\"userAgent\":\"\",\"userId\":\"285e0849-a706-4a9a-9eb1-f4e21cc78793\",\"wids\":\"1997b4d3-0g8d-90cb-bhj5-d80n3122e98 1997b4d3-0g8d-90cb-bhj5-d80n3122e99 1997b4d3-0g8d-90cb-bhj5-d80n3122e80 1997b4d3-0g8d-90cb-bhj5-d80n3122e83\"},\"resourceId\":\"/TENANTS/AB47545B-420E-46FG-C4DC-8F7697K1AADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"404\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"time\":\"2024-03-07T16:42:22.8491400Z\"}", + "outcome": "failure", "type": [ "access" ] @@ -525,9 +537,13 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 846544000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"durationMs\":846544,\"location\":\"UK South\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"beta\",\"properties\":{\"apiVersion\":\"beta\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"0\",\"clientRequestId\":\"2fe56789-a848-4c93-9d2d-5675972ardk9\",\"durationMs\":846544,\"identityProvider\":null,\"ipAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"location\":\"UK South\",\"operationId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"requestId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/beta/devices?$select=displayName,id,deviceId\\\\u0026$search=%22displayName:a%22\\\\u0026$top=30\",\"responseSizeBytes\":0,\"responseStatusCode\":200,\"roles\":null,\"scopes\":\"AccessReview.ReadWrite.All AuditLog.Read.All ChangeManagement.Read.All ConsentRequest.Create ConsentRequest.Read ConsentRequest.ReadApprove.All ConsentRequest.ReadWrite.All CustomSecAttributeAuditLogs.Read.All Directory.AccessAsUser.All Directory.Read.All Directory.ReadWrite.All Directory.Write.Restricted DirectoryRecommendations.Read.All DirectoryRecommendations.ReadWrite.All email EntitlementManagement.Read.All Group.ReadWrite.All IdentityProvider.ReadWrite.All IdentityRiskEvent.ReadWrite.All IdentityRiskyServicePrincipal.ReadWrite.All IdentityRiskyUser.ReadWrite.All IdentityUserFlow.Read.All LifecycleWorkflows.ReadWrite.All openid Policy.Read.All Policy.Read.IdentityProtection Policy.ReadWrite.AuthenticationFlows Policy.ReadWrite.AuthenticationMethod Policy.ReadWrite.ConditionalAccess Policy.ReadWrite.ExternalIdentities Policy.ReadWrite.IdentityProtection Policy.ReadWrite.MobilityManagement profile Reports.Read.All RoleManagement.ReadWrite.Directory RoleManagement.ReadWrite.Exchange SecurityEvents.ReadWrite.All TrustFrameworkKeySet.Read.All User.Export.All User.ReadWrite.All UserAuthenticationMethod.ReadWrite.All\",\"servicePrincipalId\":null,\"signInActivityId\":\"signin_Activity-Id\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"timeGenerated\":\"2024-03-07T16:42:12.0485843Z\",\"tokenIssuedAt\":\"2024-03-07T16:36:51Z\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0\",\"userId\":\"285e0849-a706-4a9a-9eb1-f4e21cc78793\",\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3122e67 a207b4d3-0g8d-90cb-bhj5-d80n3122e69 a207b4d3-0g8d-90cb-bhj5-d80n3122e89\"},\"resourceId\":\"/TENANTS/AB47545B-420E-46FG-C4DC-8F7697K1AADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"time\":\"2024-03-07T16:42:12.0485843Z\"}", + "outcome": "success", "type": [ "access" ] @@ -678,9 +694,13 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 1100725000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", + "outcome": "success", "type": [ "access" ] @@ -828,9 +848,13 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 1100725000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"C_DeviceId\": \"abc123\",\"c_Sid\":\"xyz000\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", + "outcome": "success", "type": [ "access" ] diff --git a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json index c87a3ad2030..15f836c6658 100644 --- a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json +++ b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json @@ -17,6 +17,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"01/09/2007 09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -44,6 +47,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"1/9/2007 09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -71,6 +77,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"01/09/2007 09:41:00 AM\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -98,6 +107,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"1/9/2007 9:41:00 AM\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -125,6 +137,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"1/9/2007 10:41:00 AM +01:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -152,6 +167,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -179,6 +197,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.22Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -206,6 +227,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.6816663Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -233,6 +257,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.535404056Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -260,6 +287,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.992099+00:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ @@ -287,6 +317,9 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T11:41:00+02:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ diff --git a/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml index ce7b0278249..8bff97688a2 100644 --- a/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml @@ -9,10 +9,6 @@ processors: field: event.kind value: event tag: set-event_kind - - append: - field: event.type - value: access - tag: append-event_type - rename: field: azure target_field: azure-eventhub @@ -422,6 +418,51 @@ processors: - append: field: error.message value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: event.category + value: api + tag: append_api_into_event_category + allow_duplicates: false + - append: + field: event.type + value: access + tag: append_access_into_event_type + allow_duplicates: false + if: ctx.http?.request?.method == null || ctx.http.request.method == 'GET' || ctx.http.request.method == 'HEAD' + - append: + field: event.type + value: creation + tag: append_creation_into_event_type + allow_duplicates: false + if: ctx.http?.request?.method == 'POST' + - append: + field: event.type + value: change + tag: append_change_into_event_type + allow_duplicates: false + if: ctx.http?.request?.method == 'PATCH' || ctx.http?.request?.method == 'PUT' + - append: + field: event.type + value: deletion + tag: append_deletion_into_event_type + allow_duplicates: false + if: ctx.http?.request?.method == 'DELETE' + - append: + field: event.type + value: denied + tag: append_denied_into_event_type + allow_duplicates: false + if: ctx.http?.response?.status_code == 401 || ctx.http?.response?.status_code == 403 + - set: + field: event.outcome + value: success + tag: set-event_outcome-success + if: ctx.http?.response?.status_code != null && ctx.http.response.status_code >= 200 && ctx.http.response.status_code < 300 + - set: + field: event.outcome + value: failure + tag: set-event_outcome-failure + if: ctx.http?.response?.status_code != null && ctx.http.response.status_code >= 400 - pipeline: name: '{{ IngestPipeline "azure-shared-pipeline" }}' tag: pipeline-azure-shared-pipeline diff --git a/packages/azure/data_stream/graphactivitylogs/sample_event.json b/packages/azure/data_stream/graphactivitylogs/sample_event.json index 2558fec3160..82cd191bd75 100644 --- a/packages/azure/data_stream/graphactivitylogs/sample_event.json +++ b/packages/azure/data_stream/graphactivitylogs/sample_event.json @@ -78,9 +78,13 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 1213372224, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", + "outcome": "success", "type": [ "access" ] @@ -128,4 +132,4 @@ "path": "/v1.0/directoryRoles", "scheme": "https" } -} \ No newline at end of file +} diff --git a/packages/azure/docs/graphactivitylogs.md b/packages/azure/docs/graphactivitylogs.md index 9344f266688..68a52285930 100644 --- a/packages/azure/docs/graphactivitylogs.md +++ b/packages/azure/docs/graphactivitylogs.md @@ -162,9 +162,13 @@ An example event for `graphactivitylogs` looks as following: }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 1213372224, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", + "outcome": "success", "type": [ "access" ] diff --git a/packages/azure/manifest.yml b/packages/azure/manifest.yml index ef84192596d..3f9e5b38457 100644 --- a/packages/azure/manifest.yml +++ b/packages/azure/manifest.yml @@ -1,6 +1,6 @@ name: azure title: Azure Logs -version: "1.37.1" +version: "1.37.2" description: This Elastic integration collects logs from Azure type: integration icons: diff --git a/packages/github/changelog.yml b/packages/github/changelog.yml index 0f29eaca0ec..ed0892d7400 100644 --- a/packages/github/changelog.yml +++ b/packages/github/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "2.25.2" + changes: + - description: Add `event.action` to the `issues` data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/20276 - version: "2.25.1" changes: - description: Set `subobjects` to `false` on the audit `ruleset_conditions*` `parameters`/`old_parameters` objects. For `repository_property` targets GitHub sends `include`/`exclude` as `{name, source, property_values}` objects instead of repository-name strings; the object shape collided with the `keyword` mapping and was rejected to the failure store. Disabling subobjects keeps the existing `include`/`exclude`/`repository_ids` keyword fields for the string form while letting object-form attributes map as dotted keyword leaves (`include.name`, and so on). diff --git a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json index 419b14cec9b..e97d39db933 100644 --- a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json +++ b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json @@ -6,6 +6,7 @@ "version": "8.11.0" }, "event": { + "action": "opened", "created": "2011-04-22T13:33:48.000Z", "kind": "event", "original": "{\"id\":1,\"node_id\":\"MDU6SXNzdWUx\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"number\":1347,\"state\":\"open\",\"title\":\"Found a bug\",\"body\":\"I'm having a problem with this.\",\"user\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":true},\"labels\":[{\"id\":208045946,\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\",\"name\":\"bug\",\"description\":\"Something isn't working\",\"color\":\"f29513\",\"default\":true}],\"assignee\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"assignees\":[{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false}],\"milestone\":{\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"id\":1002604,\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"state\":\"open\",\"title\":\"v1.0\",\"description\":\"Tracking milestone for version 1.0\",\"creator\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"open_issues\":4,\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"closed_at\":\"2013-02-12T13:22:01Z\",\"due_on\":\"2012-10-09T23:39:01Z\"},\"locked\":true,\"active_lock_reason\":\"too heated\",\"comments\":0,\"pull_request\":{\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\"},\"closed_at\":null,\"created_at\":\"2011-04-22T13:33:48Z\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"closed_by\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"repository\": {\"id\":1296269,\"node_id\":\"MDEwOlJlcG9zaXRvcnkxMjk2MjY5\",\"name\":\"Hello-World\",\"full_name\":\"octocat/Hello-World\",\"owner\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"private\":false,\"html_url\":\"https://github.com/octocat/Hello-World\",\"description\":\"This your first repo!\",\"fork\":false,\"url\":\"https://api.github.com/repos/octocat/Hello-World\",\"archive_url\":\"https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}\",\"assignees_url\":\"https://api.github.com/repos/octocat/Hello-World/assignees{/user}\",\"blobs_url\":\"https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}\",\"branches_url\":\"https://api.github.com/repos/octocat/Hello-World/branches{/branch}\",\"collaborators_url\":\"https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}\",\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/comments{/number}\",\"commits_url\":\"https://api.github.com/repos/octocat/Hello-World/commits{/sha}\",\"compare_url\":\"https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}\",\"contents_url\":\"https://api.github.com/repos/octocat/Hello-World/contents/{+path}\",\"contributors_url\":\"https://api.github.com/repos/octocat/Hello-World/contributors\",\"deployments_url\":\"https://api.github.com/repos/octocat/Hello-World/deployments\",\"downloads_url\":\"https://api.github.com/repos/octocat/Hello-World/downloads\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/events\",\"forks_url\":\"https://api.github.com/repos/octocat/Hello-World/forks\",\"git_commits_url\":\"https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}\",\"git_refs_url\":\"https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}\",\"git_tags_url\":\"https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}\",\"git_url\":\"git:github.com/octocat/Hello-World.git\",\"issue_comment_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}\",\"issue_events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/events{/number}\",\"issues_url\":\"https://api.github.com/repos/octocat/Hello-World/issues{/number}\",\"keys_url\":\"https://api.github.com/repos/octocat/Hello-World/keys{/key_id}\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/labels{/name}\",\"languages_url\":\"https://api.github.com/repos/octocat/Hello-World/languages\",\"merges_url\":\"https://api.github.com/repos/octocat/Hello-World/merges\",\"milestones_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones{/number}\",\"notifications_url\":\"https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}\",\"pulls_url\":\"https://api.github.com/repos/octocat/Hello-World/pulls{/number}\",\"releases_url\":\"https://api.github.com/repos/octocat/Hello-World/releases{/id}\",\"ssh_url\":\"git@github.com:octocat/Hello-World.git\",\"stargazers_url\":\"https://api.github.com/repos/octocat/Hello-World/stargazers\",\"statuses_url\":\"https://api.github.com/repos/octocat/Hello-World/statuses/{sha}\",\"subscribers_url\":\"https://api.github.com/repos/octocat/Hello-World/subscribers\",\"subscription_url\":\"https://api.github.com/repos/octocat/Hello-World/subscription\",\"tags_url\":\"https://api.github.com/repos/octocat/Hello-World/tags\",\"teams_url\":\"https://api.github.com/repos/octocat/Hello-World/teams\",\"trees_url\":\"https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}\",\"clone_url\":\"https://github.com/octocat/Hello-World.git\",\"mirror_url\":\"git:git.example.com/octocat/Hello-World\",\"hooks_url\":\"https://api.github.com/repos/octocat/Hello-World/hooks\",\"svn_url\":\"https://svn.github.com/octocat/Hello-World\",\"homepage\":\"https://github.com\",\"language\":null,\"forks_count\":9,\"stargazers_count\":80,\"watchers_count\":80,\"size\":108,\"default_branch\":\"master\",\"open_issues_count\":0,\"is_template\":true,\"topics\":[\"octocat\",\"atom\",\"electron\",\"api\"],\"has_issues\":true,\"has_projects\":true,\"has_wiki\":true,\"has_pages\":false,\"has_downloads\":true,\"archived\":false,\"disabled\":false,\"visibility\":\"public\",\"pushed_at\":\"2011-01-26T19:06:43Z\",\"created_at\":\"2011-01-26T19:01:12Z\",\"updated_at\":\"2011-01-26T19:14:43Z\",\"permissions\":{\"admin\":false,\"push\":false,\"pull\":true},\"allow_rebase_merge\":true,\"template_repository\":null,\"temp_clone_token\":\"ABTLWHOULUVAXGTRYU7OC2876QJ2O\",\"allow_squash_merge\":true,\"allow_auto_merge\":false,\"delete_branch_on_merge\":true,\"allow_merge_commit\":true,\"subscribers_count\":42,\"network_count\":0,\"license\":{\"key\":\"mit\",\"name\":\"MIT License\",\"url\":\"https://api.github.com/licenses/mit\",\"spdx_id\":\"MIT\",\"node_id\":\"MDc6TGljZW5zZW1pdA==\",\"html_url\":\"https://github.com/licenses/mit\"},\"forks\":1,\"open_issues\":1,\"watchers\":1},\"author_association\":\"COLLABORATOR\",\"state_reason\":\"completed\"}", @@ -114,6 +115,7 @@ "version": "8.11.0" }, "event": { + "action": "opened", "created": "2022-11-23T15:07:18.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4710\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/events\",\"html_url\":\"https://github.com/elastic/integrations/issues/4710\",\"id\":1461928292,\"node_id\":\"I_kwDODAw23M5XI0Fk\",\"number\":4710,\"title\":\"Custom STIX Package\",\"user\":{\"login\":\"jamiehynds\",\"id\":62879768,\"node_id\":\"MDQ6VXNlcjYyODc5NzY4\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/62879768?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/jamiehynds\",\"html_url\":\"https://github.com/jamiehynds\",\"followers_url\":\"https://api.github.com/users/jamiehynds/followers\",\"following_url\":\"https://api.github.com/users/jamiehynds/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/jamiehynds/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/jamiehynds/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/jamiehynds/subscriptions\",\"organizations_url\":\"https://api.github.com/users/jamiehynds/orgs\",\"repos_url\":\"https://api.github.com/users/jamiehynds/repos\",\"events_url\":\"https://api.github.com/users/jamiehynds/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/jamiehynds/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":3104073484,\"node_id\":\"MDU6TGFiZWwzMTA0MDczNDg0\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:Threat%20Intel\",\"name\":\"Integration:Threat Intel\",\"color\":\"ffffff\",\"default\":false,\"description\":\"\"}],\"state\":\"open\",\"locked\":false,\"assignee\":{\"login\":\"P1llus\",\"id\":8027539,\"node_id\":\"MDQ6VXNlcjgwMjc1Mzk=\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/8027539?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/P1llus\",\"html_url\":\"https://github.com/P1llus\",\"followers_url\":\"https://api.github.com/users/P1llus/followers\",\"following_url\":\"https://api.github.com/users/P1llus/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/P1llus/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/P1llus/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/P1llus/subscriptions\",\"organizations_url\":\"https://api.github.com/users/P1llus/orgs\",\"repos_url\":\"https://api.github.com/users/P1llus/repos\",\"events_url\":\"https://api.github.com/users/P1llus/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/P1llus/received_events\",\"type\":\"User\",\"site_admin\":false},\"assignees\":[{\"login\":\"P1llus\",\"id\":8027539,\"node_id\":\"MDQ6VXNlcjgwMjc1Mzk=\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/8027539?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/P1llus\",\"html_url\":\"https://github.com/P1llus\",\"followers_url\":\"https://api.github.com/users/P1llus/followers\",\"following_url\":\"https://api.github.com/users/P1llus/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/P1llus/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/P1llus/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/P1llus/subscriptions\",\"organizations_url\":\"https://api.github.com/users/P1llus/orgs\",\"repos_url\":\"https://api.github.com/users/P1llus/repos\",\"events_url\":\"https://api.github.com/users/P1llus/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/P1llus/received_events\",\"type\":\"User\",\"site_admin\":false}],\"milestone\":null,\"comments\":2,\"created_at\":\"2022-11-23T15:06:34Z\",\"updated_at\":\"2022-11-23T15:07:18Z\",\"closed_at\":null,\"author_association\":\"NONE\",\"active_lock_reason\":null,\"body\":\"Structured Threat Information Expression (STIX) is a language for expressing cyber threat and observable information. While we have several Threat Intel integrations which map STIX formatted data to Elastic Common Schema, users will always have need to ingest IOC's from threat feeds that we don't support out of the box. 'How do I ingest STIX feeds' remains a very common questions across community Slack, Discuss, Github, etc. A custom package would solve for this. \\r\\n\\r\\nTo allow for the broad range of STIX formatted feeds, we should provide a way for users to ingest data from ANY STIX feed, via a 'Custom STIX' package. The package will leverage our httpjson input under the hood, but include an ingest pipeline which maps STIX fields to ECS (we expect there'll still be a need for custom fields, as not all STIX fields have a corresponding field in ECS). \\r\\n\\r\\nThere may be cases where some feeds/vendors don't strictly conform to STIX, and in those cases, users may have to modify our pipeline and that's ok. We'll focus on correctly formatted STIX data. \",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/timeline\",\"performed_via_github_app\":null,\"state_reason\":null}", @@ -208,6 +210,7 @@ "version": "8.11.0" }, "event": { + "action": "opened", "created": "2022-11-23T14:58:03.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4707\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/events\",\"html_url\":\"https://github.com/elastic/integrations/issues/4707\",\"id\":1461726255,\"node_id\":\"I_kwDODAw23M5XICwv\",\"number\":4707,\"title\":\"[ Crowdstrike Falcon ] Parse of process field is wrong.\",\"user\":{\"login\":\"leandrojmp\",\"id\":322886,\"node_id\":\"MDQ6VXNlcjMyMjg4Ng==\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/322886?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/leandrojmp\",\"html_url\":\"https://github.com/leandrojmp\",\"followers_url\":\"https://api.github.com/users/leandrojmp/followers\",\"following_url\":\"https://api.github.com/users/leandrojmp/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/leandrojmp/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/leandrojmp/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/leandrojmp/subscriptions\",\"organizations_url\":\"https://api.github.com/users/leandrojmp/orgs\",\"repos_url\":\"https://api.github.com/users/leandrojmp/repos\",\"events_url\":\"https://api.github.com/users/leandrojmp/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/leandrojmp/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":2716642190,\"node_id\":\"MDU6TGFiZWwyNzE2NjQyMTkw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:Crowdstrike\",\"name\":\"Integration:Crowdstrike\",\"color\":\"FFFFFF\",\"default\":false,\"description\":null}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":1,\"created_at\":\"2022-11-23T13:03:54Z\",\"updated_at\":\"2022-11-23T14:58:03Z\",\"closed_at\":null,\"author_association\":\"NONE\",\"active_lock_reason\":null,\"body\":\"Hello,\\r\\n\\r\\nThe parse of the process fields in the Crowdstrike Falcon Pipeline is wrong, it is creating fields with dots in the name instead of nested json objects.\\r\\n\\r\\nIt creates this:\\r\\n```\\r\\n{\\r\\n \\\"process.executable\\\": \\\"value\\\"\\r\\n}\\r\\n```\\r\\n\\r\\nInstead of\\r\\n\\r\\n```\\r\\n{\\r\\n \\\"process\\\": {\\r\\n \\\"executable\\\": \\\"value\\\"\\r\\n }\\r\\n}\\r\\n```\\r\\n\\r\\nThis same issue was present in the [filebeat integration](https://github.com/elastic/beats/issues/27622) and I submitted a [fix](https://github.com/elastic/beats/pull/27623) more than an year ago.\\r\\n\\r\\nI will submit a PR later with the same fix, but I'm creating this issue to register the problem.\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", @@ -283,6 +286,7 @@ "version": "8.11.0" }, "event": { + "action": "opened", "created": "2022-11-23T11:15:48.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4704\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/events\",\"html_url\":\"https://github.com/elastic/integrations/pull/4704\",\"id\":1461524465,\"node_id\":\"PR_kwDODAw23M5DjMOh\",\"number\":4704,\"title\":\"[Enhancement] [Infoblox Bloxone DDI] Update the Pagination Termination Condition and Added Filter instead of KQL in visualizations\",\"user\":{\"login\":\"vinit-elastic\",\"id\":89848047,\"node_id\":\"MDQ6VXNlcjg5ODQ4MDQ3\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/89848047?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/vinit-elastic\",\"html_url\":\"https://github.com/vinit-elastic\",\"followers_url\":\"https://api.github.com/users/vinit-elastic/followers\",\"following_url\":\"https://api.github.com/users/vinit-elastic/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/vinit-elastic/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/vinit-elastic/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/vinit-elastic/subscriptions\",\"organizations_url\":\"https://api.github.com/users/vinit-elastic/orgs\",\"repos_url\":\"https://api.github.com/users/vinit-elastic/repos\",\"events_url\":\"https://api.github.com/users/vinit-elastic/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/vinit-elastic/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":1498531540,\"node_id\":\"MDU6TGFiZWwxNDk4NTMxNTQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/enhancement\",\"name\":\"enhancement\",\"color\":\"a2eeef\",\"default\":true,\"description\":\"New feature or request\"},{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":4528694847,\"node_id\":\"LA_kwDODAw23M8AAAABDe5mPw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:infoblox_bloxone_ddi\",\"name\":\"Integration:infoblox_bloxone_ddi\",\"color\":\"FFFFFF\",\"default\":false,\"description\":\"Infoblox BloxOne DDI (DNS, DHCP, IP management)\"}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":4,\"created_at\":\"2022-11-23T10:57:54Z\",\"updated_at\":\"2022-11-23T11:15:48Z\",\"closed_at\":null,\"author_association\":\"COLLABORATOR\",\"active_lock_reason\":null,\"draft\":false,\"pull_request\":{\"url\":\"https://api.github.com/repos/elastic/integrations/pulls/4704\",\"html_url\":\"https://github.com/elastic/integrations/pull/4704\",\"diff_url\":\"https://github.com/elastic/integrations/pull/4704.diff\",\"patch_url\":\"https://github.com/elastic/integrations/pull/4704.patch\",\"merged_at\":null},\"body\":\" Type of change\\r\\n- Enhancement\\r\\n\\r\\n\\r\\n## What does this PR do?\\r\\nUpdate the Pagination Termination Condition for Infoblox Bloxone DDI connector.\\r\\n\\r\\nCurrent condition for pagination termination contains `[[else]][[.last_response.terminate_pagination]][[end]]` which results in error logs when pagination is completed.\\r\\n\\r\\nRemoving this `else` condition will not result in error logs.\\r\\n\\r\\n\\r\\n\\r\\n## Checklist\\r\\n\\r\\n- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.\\r\\n- [x] I have verified that all data streams collect metrics or logs.\\r\\n- [x] I have added an entry to my package's `changelog.yml` file.\\r\\n- [x] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).\\r\\n\\r\\n\\r\\n\\r\\n## How to test this PR locally\\r\\n- Clone integrations repo.\\r\\n- Install elastic package locally.\\r\\n- Start elastic stack using elastic-package.\\r\\n- Move to integrations/packages/infoblox_bloxone_ddi directory.\\r\\n- Run the following command to run tests. \\r\\n> elastic-package test \\r\\n\\r\\n\\r\\n## Related issues\\r\\n\\r\\n\\r\\n- Relates https://github.com/elastic/integrations/issues/4527\\r\\n\\r\\n## Screenshots\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529720-18c110cd-5343-4d70-bbfb-eed0b81313af.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529765-4b183071-6ed9-4bc8-8a98-fd04955bb4d7.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529819-78128d98-630e-49e5-bf97-f86059c0cc26.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529936-df7e3d6f-031e-4b0c-992f-93707a507735.png)\\r\\n\\r\\n\\r\\n\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", @@ -370,6 +374,7 @@ "version": "8.11.0" }, "event": { + "action": "opened", "created": "2022-11-23T11:23:56.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4703\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/events\",\"html_url\":\"https://github.com/elastic/integrations/pull/4703\",\"id\":1461503410,\"node_id\":\"PR_kwDODAw23M5DjHjk\",\"number\":4703,\"title\":\"[Enhancement] [AWS Security Hub] Update the Pagination Termination Condition\",\"user\":{\"login\":\"vinit-elastic\",\"id\":89848047,\"node_id\":\"MDQ6VXNlcjg5ODQ4MDQ3\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/89848047?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/vinit-elastic\",\"html_url\":\"https://github.com/vinit-elastic\",\"followers_url\":\"https://api.github.com/users/vinit-elastic/followers\",\"following_url\":\"https://api.github.com/users/vinit-elastic/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/vinit-elastic/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/vinit-elastic/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/vinit-elastic/subscriptions\",\"organizations_url\":\"https://api.github.com/users/vinit-elastic/orgs\",\"repos_url\":\"https://api.github.com/users/vinit-elastic/repos\",\"events_url\":\"https://api.github.com/users/vinit-elastic/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/vinit-elastic/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":1498531540,\"node_id\":\"MDU6TGFiZWwxNDk4NTMxNTQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/enhancement\",\"name\":\"enhancement\",\"color\":\"a2eeef\",\"default\":true,\"description\":\"New feature or request\"},{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":2607750240,\"node_id\":\"MDU6TGFiZWwyNjA3NzUwMjQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:AWS\",\"name\":\"Integration:AWS\",\"color\":\"FFFFFF\",\"default\":false,\"description\":\"\"}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":4,\"created_at\":\"2022-11-23T10:44:59Z\",\"updated_at\":\"2022-11-23T11:23:56Z\",\"closed_at\":null,\"author_association\":\"COLLABORATOR\",\"active_lock_reason\":null,\"draft\":false,\"pull_request\":{\"url\":\"https://api.github.com/repos/elastic/integrations/pulls/4703\",\"html_url\":\"https://github.com/elastic/integrations/pull/4703\",\"diff_url\":\"https://github.com/elastic/integrations/pull/4703.diff\",\"patch_url\":\"https://github.com/elastic/integrations/pull/4703.patch\",\"merged_at\":null},\"body\":\" Type of change\\r\\n- Enhancement\\r\\n\\r\\n\\r\\n## What does this PR do?\\r\\nUpdate the Pagination Termination Condition for AWS Security Hub connector.\\r\\n\\r\\nCurrent condition for pagination termination contains `[[else]][[.last_response.terminate_pagination]][[end]]` which results in error logs when pagination is completed.\\r\\n\\r\\nRemoving this `else` condition will not result in error logs.\\r\\n\\r\\n\\r\\n\\r\\n## Checklist\\r\\n\\r\\n- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.\\r\\n- [x] I have verified that all data streams collect metrics or logs.\\r\\n- [x] I have added an entry to my package's `changelog.yml` file.\\r\\n- [x] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).\\r\\n\\r\\n\\r\\n\\r\\n## How to test this PR locally\\r\\n- Clone integrations repo.\\r\\n- Install elastic package locally.\\r\\n- Start elastic stack using elastic-package.\\r\\n- Move to integrations/packages/aws directory.\\r\\n- Run the following command to run tests. \\r\\n> elastic-package test \\r\\n\\r\\n\\r\\n## Related issues\\r\\n\\r\\n\\r\\n- Relates https://github.com/elastic/integrations/issues/4527\\r\\n\\r\\n## Screenshots\\r\\n![image](https://user-images.githubusercontent.com/89848047/203526900-06519c95-3de5-4f88-a65d-555d03d7f9a1.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203527000-b050f059-03c6-4ead-a88e-9f2e42efb537.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203527123-ea1f8513-8371-4d06-8a17-b71c0dae7a5a.png)\\r\\n\\r\\n\\r\\n\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", diff --git a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml index fc7738b2a10..d9b9e2bdc6b 100644 --- a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml @@ -26,18 +26,38 @@ processors: - set: field: event.kind value: event + # The API returns a snapshot of the issue's current state, not a discrete action, so + # event.type is inferred from timestamps. `creation` applies only while the issue has + # never been modified; reopened and closed issues have updated_at > created_at. - append: field: event.type value: creation if: ctx.github?.issues?.created_at == ctx.github?.issues?.updated_at + # A closed issue or a merged pull request has reached the end of its lifecycle. - append: field: event.type value: deletion if: ctx.github?.issues?.closed_at != null || ctx.github?.issues?.pull_request?.merged_at != null + # Anything still open but modified since it was created has been edited or reopened. - append: field: event.type value: change if: ctx.github?.issues?.created_at != ctx.github?.issues?.updated_at && ctx.github?.issues?.closed_at == null && ctx.github?.issues?.pull_request?.merged_at == null + - set: + field: event.action + value: reopened + tag: set_event_action_reopened + if: ctx.github?.issues?.state == 'open' && ctx.github.issues.state_reason == 'reopened' + - set: + field: event.action + value: opened + tag: set_event_action_opened + if: ctx.github?.issues?.state == 'open' && ctx.github.issues.state_reason != 'reopened' + - set: + field: event.action + value: closed + tag: set_event_action_closed + if: ctx.github?.issues?.state == 'closed' - date: field: github.issues.updated_at formats: diff --git a/packages/github/data_stream/issues/sample_event.json b/packages/github/data_stream/issues/sample_event.json index 13da3db6cf9..0ea4abee71c 100644 --- a/packages/github/data_stream/issues/sample_event.json +++ b/packages/github/data_stream/issues/sample_event.json @@ -1,30 +1,31 @@ { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "e2949142-e6a4-47dc-a8af-d07a247d37d0", - "id": "2667fb13-13c1-4632-bdeb-e8da7d3cae48", - "name": "elastic-agent-93776", + "ephemeral_id": "0aa2f45d-e0a7-421c-ade5-45aa21712041", + "id": "906bbf2a-d522-4c69-829f-8d0d4d615392", + "name": "elastic-agent-18769", "type": "filebeat", "version": "8.19.10" }, "data_stream": { "dataset": "github.issues", - "namespace": "90057", + "namespace": "88899", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "2667fb13-13c1-4632-bdeb-e8da7d3cae48", + "id": "906bbf2a-d522-4c69-829f-8d0d4d615392", "snapshot": false, "version": "8.19.10" }, "event": { + "action": "opened", "agent_id_status": "verified", "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2026-03-31T09:12:47Z", + "ingested": "2026-07-29T03:53:27Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", "type": [ diff --git a/packages/github/docs/README.md b/packages/github/docs/README.md index 67de25a7089..f47b7549e6c 100644 --- a/packages/github/docs/README.md +++ b/packages/github/docs/README.md @@ -957,30 +957,31 @@ An example event for `issues` looks as following: { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "e2949142-e6a4-47dc-a8af-d07a247d37d0", - "id": "2667fb13-13c1-4632-bdeb-e8da7d3cae48", - "name": "elastic-agent-93776", + "ephemeral_id": "0aa2f45d-e0a7-421c-ade5-45aa21712041", + "id": "906bbf2a-d522-4c69-829f-8d0d4d615392", + "name": "elastic-agent-18769", "type": "filebeat", "version": "8.19.10" }, "data_stream": { "dataset": "github.issues", - "namespace": "90057", + "namespace": "88899", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "2667fb13-13c1-4632-bdeb-e8da7d3cae48", + "id": "906bbf2a-d522-4c69-829f-8d0d4d615392", "snapshot": false, "version": "8.19.10" }, "event": { + "action": "opened", "agent_id_status": "verified", "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2026-03-31T09:12:47Z", + "ingested": "2026-07-29T03:53:27Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", "type": [ diff --git a/packages/github/manifest.yml b/packages/github/manifest.yml index 0e4257c5d38..cac4c5e511c 100644 --- a/packages/github/manifest.yml +++ b/packages/github/manifest.yml @@ -1,6 +1,6 @@ name: github title: GitHub -version: "2.25.1" +version: "2.25.2" description: Collect logs from GitHub with Elastic Agent. type: integration format_version: "3.4.0" diff --git a/packages/google_workspace/_dev/deploy/docker/docker-compose.yml b/packages/google_workspace/_dev/deploy/docker/docker-compose.yml index d75723e84a4..458c7e5e964 100644 --- a/packages/google_workspace/_dev/deploy/docker/docker-compose.yml +++ b/packages/google_workspace/_dev/deploy/docker/docker-compose.yml @@ -15,6 +15,12 @@ services: echo "This puts the generated private key into a single string that can be interpolated in the credentials file."; awk -v var="$$(sed -E ':a;N;$$!ba;s/\r{0,1}\n/\\\\n/g' pkcs8.key)" '{sub(/the-key/,var)}1' /credentials.json > /config/credentials.json; sleep 1000 + healthcheck: + test: ["CMD-SHELL", "test -f /config/credentials.json"] + interval: 2s + timeout: 2s + retries: 90 + start_period: 3s google_workspace: image: docker.elastic.co/observability/stream:v0.18.0 hostname: google_workspace @@ -29,4 +35,5 @@ services: - --addr=:8080 - --config=/config.yml depends_on: - - creds + creds: + condition: service_healthy diff --git a/packages/google_workspace/changelog.yml b/packages/google_workspace/changelog.yml index b97557ce006..c0ac96f32cb 100644 --- a/packages/google_workspace/changelog.yml +++ b/packages/google_workspace/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.5.2" + changes: + - description: Add missing ECS event categorization for the gcp, rules, calendar, group_enterprise, context_aware_access, meet, chat, chrome, login, device, keep, and vault data streams. + type: bugfix + link: https://github.com/elastic/integrations/pull/20276 - version: "3.5.1" changes: - description: Guard the httpjson `next_start_date` cursor so an empty API response no longer fails template evaluation and flaps the input between HEALTHY and DEGRADED. diff --git a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml index 4fbd9c0fc9a..f0497f562a3 100644 --- a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml @@ -110,7 +110,7 @@ processors: change_calendar_description: configuration change_calendar_location: configuration change_calendar_timezone: configuration - change_calendar_title: configuration + change_calendar_title: configuration add_subscription: configuration delete_subscription: configuration change_appointment_schedule: configuration @@ -120,20 +120,23 @@ processors: delete_event: configuration add_event_guest: configuration change_event_guest_response_auto: configuration - remove_event_guest: configuration + remove_event_guest: configuration change_event_guest_response: configuration change_event: configuration remove_event_from_trash: configuration restore_event: configuration change_event_start_time: configuration - change_event_title: configuration + change_event_title: configuration transfer_event_completed: configuration transfer_event_requested: configuration source: |- ctx.event = ctx.event ?: [:]; - def category = []; - category.add(params.get(ctx.google_workspace.calendar.name)); - ctx.event.category = category; + def category = params.get(ctx.google_workspace.calendar.name); + if (category == null) { + ctx.event.remove('category'); + } else { + ctx.event.category = [category]; + } on_failure: - append: field: error.message @@ -151,7 +154,7 @@ processors: change_calendar_description: change export_calendar: info change_calendar_location: change - print_preview_calendar: info + print_preview_calendar: info change_calendar_timezone: change change_calendar_title: change notification_triggered: info @@ -164,29 +167,32 @@ processors: delete_event: deletion add_event_guest: change change_event_guest_response_auto: change - remove_event_guest: change + remove_event_guest: change change_event_guest_response: change change_event: change print_preview_event: info remove_event_from_trash: change restore_event: change change_event_start_time: change - change_event_title: change + change_event_title: change transfer_event_completed: change transfer_event_requested: info interop_freebusy_lookup_outbound_successful: info - interop_freebusy_lookup_inbound_successful: info + interop_freebusy_lookup_inbound_successful: info interop_exchange_resource_availability_lookup_successful: info interop_exchange_resource_list_lookup_successful: info interop_freebusy_lookup_outbound_unsuccessful: info interop_freebusy_lookup_inbound_unsuccessful: info - interop_exchange_resource_availability_lookup_unsuccessful: info - interop_exchange_resource_list_lookup_unsuccessful: info + interop_exchange_resource_availability_lookup_unsuccessful: info + interop_exchange_resource_list_lookup_unsuccessful: info source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.calendar.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.calendar.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/calendar/sample_event.json b/packages/google_workspace/data_stream/calendar/sample_event.json index a9163013ee4..de40b7e420e 100644 --- a/packages/google_workspace/data_stream/calendar/sample_event.json +++ b/packages/google_workspace/data_stream/calendar/sample_event.json @@ -1,24 +1,24 @@ { "@timestamp": "2025-04-01T07:00:40.262Z", "agent": { - "ephemeral_id": "c496161a-177e-4359-8324-e11405aeeaad", - "id": "1ab21f00-c503-4805-b1de-01dacd186aef", - "name": "elastic-agent-44155", + "ephemeral_id": "0bf0c46e-128f-4c5f-9ef3-be0324853874", + "id": "84d83968-c050-49a6-a9f8-d1430810bcdc", + "name": "elastic-agent-49212", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.calendar", - "namespace": "50432", + "namespace": "66608", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "1ab21f00-c503-4805-b1de-01dacd186aef", - "snapshot": true, - "version": "8.18.0" + "id": "84d83968-c050-49a6-a9f8-d1430810bcdc", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "delete-calendar", @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.calendar", "id": "1", - "ingested": "2025-04-22T12:01:05Z", + "ingested": "2026-07-29T05:49:29Z", "kind": "event", "original": "{\"actor\":{\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"delete_calendar\",\"parameters\":[{\"name\":\"calendar_id\",\"value\":\"c_abc123@group.calendar.google.com\"},{\"name\":\"api_kind\",\"value\":\"web\"},{\"name\":\"user_agent\",\"value\":\"Mozilla/5.0\"}],\"type\":\"calendar_change\"},\"id\":{\"applicationName\":\"calendar\",\"customerId\":\"1\",\"time\":\"2025-04-01T07:00:40.262Z\",\"uniqueQualifier\":\"1\"},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "calendar", diff --git a/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json b/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json index d4b27646849..a355b4bc848 100644 --- a/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json +++ b/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json @@ -1205,6 +1205,9 @@ }, "event": { "action": "attachment-download", + "category": [ + "file" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:19:50.145Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"chat\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"attachment_download\", \"parameters\": [{\"name\": \"actor\", \"value\": \"foo@bar.com\"}, {\"name\": \"room_id\", \"value\": \"1\"}, {\"name\": \"attachment_name\", \"value\": \"aW1hZ2UucG5n\"}, {\"name\": \"attachment_hash\", \"value\": \"1\"}, {\"name\": \"attachment_url\", \"value\": \"https://chat.elastic.com/download?attachment_token=1\"}]}}", @@ -1284,6 +1287,9 @@ }, "event": { "action": "attachment-upload", + "category": [ + "file" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:19:46.345Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"chat\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"attachment_upload\", \"parameters\": [{\"name\": \"room_id\", \"value\": \"1\"}, {\"name\": \"message_id\", \"value\": \"1\"}, {\"name\": \"actor\", \"value\": \"foo@bar.com\"}, {\"name\": \"attachment_name\", \"value\": \"image.png\"}, {\"name\": \"attachment_hash\", \"value\": \"1\"}, {\"name\": \"room_name\", \"value\": \"Self\"}, {\"name\": \"retention_state\", \"value\": \"PERMANENT\"}, {\"name\": \"external_room\", \"value\": \"DISABLED\"}, {\"name\": \"dlp_scan_status\", \"value\": \"DLP_NOT_APPLICABLE\"}, {\"name\": \"actor_type\", \"value\": \"NON_ADMIN\"}, {\"name\": \"conversation_type\", \"value\": \"SPACE\"}, {\"name\": \"conversation_ownership\", \"value\": \"INTERNALLY_OWNED\"}]}}", diff --git a/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml index 3c151e831f9..50b012b0fdb 100644 --- a/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml @@ -107,6 +107,8 @@ processors: lang: painless params: add_room_member: configuration + attachment_download: file + attachment_upload: file block_room: configuration block_user: configuration emoji_created: configuration @@ -125,9 +127,12 @@ processors: role_updated: iam source: |- ctx.event = ctx.event ?: [:]; - def category = []; - category.add(params.get(ctx.google_workspace.chat.name)); - ctx.event.category = category; + def category = params.get(ctx.google_workspace.chat.name); + if (category == null) { + ctx.event.remove('category'); + } else { + ctx.event.category = [category]; + } on_failure: - append: field: error.message @@ -172,9 +177,12 @@ processors: user_unblocked: change source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.chat.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.chat.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/chat/sample_event.json b/packages/google_workspace/data_stream/chat/sample_event.json index 631c09fb6e8..766450b14f1 100644 --- a/packages/google_workspace/data_stream/chat/sample_event.json +++ b/packages/google_workspace/data_stream/chat/sample_event.json @@ -1,24 +1,24 @@ { "@timestamp": "2025-03-26T05:55:02.063Z", "agent": { - "ephemeral_id": "afc7ce98-0520-45e0-94c4-64274b308642", - "id": "411b5487-ebfa-4a91-89da-d7e59f3f1cd2", - "name": "elastic-agent-11706", + "ephemeral_id": "aaf2abc8-196a-4187-b608-1f0a3cb6d0da", + "id": "bbe3c33a-56b4-4151-a0af-5a101bfb9189", + "name": "elastic-agent-33417", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chat", - "namespace": "37789", + "namespace": "83717", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "411b5487-ebfa-4a91-89da-d7e59f3f1cd2", - "snapshot": true, - "version": "8.18.0" + "id": "bbe3c33a-56b4-4151-a0af-5a101bfb9189", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "room-name-updated", @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.chat", "id": "1", - "ingested": "2025-04-16T08:53:19Z", + "ingested": "2026-07-29T05:51:24Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\",\"events\":{\"name\":\"room_name_updated\",\"parameters\":[{\"name\":\"room_id\",\"value\":\"1\"},{\"name\":\"actor\",\"value\":\"foo@bar.com\"},{\"name\":\"room_name\",\"value\":\"TEST3\"},{\"name\":\"external_room\",\"value\":\"DISABLED\"},{\"name\":\"actor_type\",\"value\":\"NON_ADMIN\"},{\"name\":\"conversation_type\",\"value\":\"SPACE\"},{\"name\":\"conversation_ownership\",\"value\":\"INTERNALLY_OWNED\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"chat\",\"customerId\":\"1\",\"time\":\"2025-03-26T05:55:02.063Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "chat", diff --git a/packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json b/packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json index 290902679f6..b73d641b5bd 100644 --- a/packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json +++ b/packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json @@ -12,12 +12,18 @@ }, "event": { "action": "browser_extension_install", + "category": [ + "package" + ], "id": "-3640711002716937498", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh@example.io\",\"profileId\":\"10111170624712104\"},\"ipAddress\":\"81.2.69.142\",\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"laaaaaaafhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"abcdefgh\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "BROWSER_EXTENSION_INSTALL" + "reason": "BROWSER_EXTENSION_INSTALL", + "type": [ + "installation" + ] }, "google_workspace": { "chrome": { @@ -139,12 +145,18 @@ }, "event": { "action": "browser_extension_install", + "category": [ + "package" + ], "id": "7437587313655252416", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh@example.io\",\"profileId\":\"109689111170624712105\"},\"etag\":\"abcdefgh/o-xkjZa6siXSekffMWaLMCnKxpg\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905286\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"aaaaaaaaabokpmkimbfghdkjmjhdgbg\"},{\"name\":\"APP_NAME\",\"value\":\"Text\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"abcdefgh\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"0.8.4\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.286Z\",\"uniqueQualifier\":\"7437587313655252416\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "BROWSER_EXTENSION_INSTALL" + "reason": "BROWSER_EXTENSION_INSTALL", + "type": [ + "installation" + ] }, "google_workspace": { "chrome": { @@ -241,10 +253,16 @@ }, "event": { "action": "unsafe_site_visit", + "category": [ + "web" + ], "id": "7437587313655252416", "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh@example.io\",\"profileId\":\"109689111170624712105\"},\"etag\":\"abcdefgh/o-xkjZa6siXSekffMWaLMCnKxpg\",\"events\":{\"name\":\"UNSAFE_SITE_VISIT\",\"parameters\":[{\"name\":\"TAB_URL\",\"value\":\"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch\"}],\"type\":\"UNSAFE_SITE_VISIT_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.286Z\",\"uniqueQualifier\":\"7437587313655252416\"},\"kind\":\"admin#reports#activity\"}", - "provider": "chrome" + "provider": "chrome", + "type": [ + "info" + ] }, "google_workspace": { "chrome": { @@ -308,13 +326,19 @@ }, "event": { "action": "content_transfer", + "category": [ + "file" + ], "hash": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824", "id": "786234589762965922973", "kind": "event", "original": "{\"actor\":{\"callerType\":\"EXTERNAL_USER\",\"email\":\"test@example.com\"},\"etag\":\"akhsdbvkhsbfdhjkgvbkjfdbkgkjaLs/mLwhjbchkjDHKBDFHJVWESDJHFBg\",\"events\":{\"name\":\"CONTENT_TRANSFER\",\"parameters\":[{\"intValue\":\"1768254290648\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"CONTENT_MATCHED_SENSITIVE_DATA_TYPES\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"143.0.7499.193\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"0skhbf8fvhwe323z\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_BROWSER\"},{\"name\":\"CONTENT_HASH\",\"value\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\"},{\"name\":\"CONTENT_NAME\",\"value\":\"/Users/test/Downloads/Hello 1.10.pdf\"},{\"name\":\"CONTENT_RISK_LEVEL\",\"value\":\"CONTENT_RISK_LEVEL_UNSPECIFIED\"},{\"name\":\"CONTENT_TRANSFER_METHOD\",\"value\":\"UNKNOWN\"},{\"name\":\"CONTENT_TYPE\",\"value\":\"application/pdf\"},{\"name\":\"DEVICE_ID\",\"value\":\"A24352S553\"},{\"name\":\"DEVICE_NAME\",\"value\":\"CW-A35FV5SG56-U\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"Mac OS X 15.7\"},{\"name\":\"DEVICE_USER\",\"value\":\"test\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"dabcdef4-abcd-1234-5678-abcdef987654\"},{\"name\":\"EVENT_RESULT\",\"value\":\"DETECTED\"},{\"name\":\"LOCAL_IP\",\"value\":\"2a02:cf40:: , 192.168.1.154, 175.16.199.1, 1.128.0.1\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.com\"},{\"name\":\"PE_HASH\",\"value\":\"\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"test@example.com\"},{\"name\":\"REMOTE_IP\",\"value\":\"175.16.199.1\"},{\"name\":\"SCAN_ID\",\"value\":\"VUHSBKVJ749Y9827947289748927985789243YUTHFRHGF983HBFIYWGEBFUIWHF792YT7I4HRIU23NBFIU2BF927YRG92IHRB9UI2344BF9272U9GTFBI9WE7FH972IW\"},{\"name\":\"TAB_URL\",\"value\":\"chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://mail.google.com/mail/u/0?ui=2\\\\u0026ik=c52e896199\\\\u0026attid=0.1\\\\u0026permmsgid=msg-f:147958972487293\\\\u0026th=skhbvjhwbv7w898vws5\\\\u0026view=att\\\\u0026disp=inline\\\\u0026realattid=f_mkgrgersggw\\\\u0026zw\\\\u0026acrobatPromotionSource=gmail_chrome-card\"},{\"name\":\"TRIGGER_DESTINATION\",\"value\":\"\"},{\"name\":\"TRIGGER_SOURCE\",\"value\":\"\"},{\"name\":\"TRIGGER_TYPE\",\"value\":\"FILE_DOWNLOAD\"},{\"name\":\"URL\",\"value\":\"blob:chrome-extension://wbhubfwouhgboewrjbgwkjgbnowlgnolwgnolw/cabcdef0-abcd-ab12-5678-71234567890b\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36,gzip(gfe)\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"A245984769D45\"},{\"intValue\":\"89076\",\"name\":\"CONTENT_SIZE\"},{\"boolValue\":false,\"name\":\"IS_ENCRYPTED\"},{\"multiValue\":[\"https://acrobat.adobe.com/dc-chrome-extension/index.html?locale=en-US\\\\u0026logAnalytics=true\\\\u0026callingApp=efaegergegwhgwtrgegeqhrthbrtgbtrn\\\\u0026lfa=false\\\\u0026rvu=true\\\\u0026version=25.12.1.2%3Aupdate\\\\u0026installSource=sideload\"],\"name\":\"IFRAME_URLS\"},{\"multiMessageValue\":[{\"parameter\":[{\"name\":\"DETECTOR_ID\",\"value\":\"EMAIL_ADDRESS\"},{\"name\":\"DETECTOR_NAME\",\"value\":\"EMAIL_ADDRESS\"}]}],\"name\":\"MATCHED_DETECTORS\"},{\"multiMessageValue\":[{\"parameter\":[{\"name\":\"IFRAME_URL_CATEGORY_ENUM_TYPE\",\"value\":\"INTERNET_AND_TECHNOLOGY__SOFTWARE\"}]}],\"name\":\"NESTED_IFRAME_URL_CATEGORIES\"}],\"type\":\"CONTENT_TRANSFER_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"Jjkvbwskj848\",\"time\":\"2026-01-12T21:44:50.648Z\",\"uniqueQualifier\":\"786234589762965922973\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "CONTENT_MATCHED_SENSITIVE_DATA_TYPES" + "reason": "CONTENT_MATCHED_SENSITIVE_DATA_TYPES", + "type": [ + "info" + ] }, "google_workspace": { "chrome": { @@ -443,12 +467,18 @@ }, "event": { "action": "content_transfer", + "category": [ + "file" + ], "hash": "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3", "id": "111999888777666555", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"firstname.lastname@example.com\",\"profileId\":\"111222333444555666\"},\"etag\":\"akhsdbvkhsbfdhjkgvbkjfdbkgkjaLs/wINdOwSdOmAiNtEsT0001ExAmPlE\",\"events\":{\"name\":\"CONTENT_TRANSFER\",\"parameters\":[{\"intValue\":\"1740820500000\",\"name\":\"TIMESTAMP\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_BROWSER\"},{\"name\":\"CONTENT_HASH\",\"value\":\"a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3\"},{\"name\":\"CONTENT_NAME\",\"value\":\"C:\\\\Users\\\\firstname.lastname\\\\Documents\\\\secret.pdf\"},{\"name\":\"CONTENT_SIZE\",\"intValue\":\"54321\"},{\"name\":\"CONTENT_TYPE\",\"value\":\"application/pdf\"},{\"boolValue\":false,\"name\":\"IS_ENCRYPTED\"},{\"name\":\"DEVICE_NAME\",\"value\":\"MYHOST\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"Windows 11\"},{\"name\":\"DEVICE_USER\",\"value\":\"MYHOST\\\\firstname.lastname\"},{\"name\":\"EVENT_RESULT\",\"value\":\"BLOCKED\"},{\"name\":\"LOCAL_IP\",\"value\":\"192.168.10.50\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"firstname.lastname@example.com\"},{\"name\":\"REMOTE_IP\",\"value\":\"198.51.100.1\"},{\"name\":\"TRIGGER_TYPE\",\"value\":\"FILE_UPLOAD\"}],\"type\":\"CONTENT_TRANSFER_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"CWIN123456\",\"time\":\"2026-03-01T09:15:00.000Z\",\"uniqueQualifier\":\"111999888777666555\"},\"kind\":\"admin#reports#activity\"}", "outcome": "failure", - "provider": "chrome" + "provider": "chrome", + "type": [ + "info" + ] }, "google_workspace": { "chrome": { @@ -544,12 +574,18 @@ }, "event": { "action": "content_transfer", + "category": [ + "file" + ], "hash": "b3a8e0e1f9ab1bfe3a36f231f676f78bb28a2b31df895b39b4d9c967f2f3a16b", "id": "222888777666555444", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"jdoe@example.com\",\"profileId\":\"222333444555666777\"},\"etag\":\"akhsdbvkhsbfdhjkgvbkjfdbkgkjaLs/cOrPdOmAiNtEsT0002ExAmPlE\",\"events\":{\"name\":\"CONTENT_TRANSFER\",\"parameters\":[{\"intValue\":\"1740924000000\",\"name\":\"TIMESTAMP\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_BROWSER\"},{\"name\":\"CONTENT_HASH\",\"value\":\"b3a8e0e1f9ab1bfe3a36f231f676f78bb28a2b31df895b39b4d9c967f2f3a16b\"},{\"name\":\"CONTENT_NAME\",\"value\":\"C:\\\\Users\\\\jdoe\\\\Desktop\\\\budget.xlsx\"},{\"name\":\"CONTENT_SIZE\",\"intValue\":\"98765\"},{\"name\":\"CONTENT_TYPE\",\"value\":\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\"},{\"boolValue\":true,\"name\":\"IS_ENCRYPTED\"},{\"name\":\"DEVICE_NAME\",\"value\":\"CORPWS001\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"Windows 11\"},{\"name\":\"DEVICE_USER\",\"value\":\"CORP\\\\jdoe@example.com\"},{\"name\":\"EVENT_RESULT\",\"value\":\"BLOCKED\"},{\"name\":\"LOCAL_IP\",\"value\":\"10.10.10.25\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"jdoe@example.com\"},{\"name\":\"REMOTE_IP\",\"value\":\"198.51.100.2\"},{\"name\":\"TRIGGER_TYPE\",\"value\":\"FILE_UPLOAD\"}],\"type\":\"CONTENT_TRANSFER_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"CWIN789012\",\"time\":\"2026-03-02T14:00:00.000Z\",\"uniqueQualifier\":\"222888777666555444\"},\"kind\":\"admin#reports#activity\"}", "outcome": "failure", - "provider": "chrome" + "provider": "chrome", + "type": [ + "info" + ] }, "google_workspace": { "chrome": { diff --git a/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml index ac24f1c75bb..b3df59998f9 100644 --- a/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml @@ -130,23 +130,30 @@ processors: tag: set_event_category_from_chrome_name lang: painless params: + browser_extension_install: package chrome_os_add_user: iam chrome_os_remove_user: iam - device_boot_state_change: configuration chrome_os_login_failure_event: authentication chrome_os_login_logout_event: authentication chrome_os_login_event: authentication chrome_os_logout_event: authentication + content_transfer: file + device_boot_state_change: configuration extension_request: configuration login_event: authentication malware_transfer: malware + sensitive_data_transfer: file + unsafe_site_visit: web source: |- if (ctx.event == null) { ctx.event = new HashMap(); } - def category = new ArrayList(); - category.add(params.get(ctx.google_workspace.chrome.name.toLowerCase())); - ctx.event.put('category', category); + def category = params.get(ctx.google_workspace.chrome.name.toLowerCase()); + if (category == null) { + ctx.event.remove('category'); + } else { + ctx.event.put('category', [category]); + } on_failure: - append: field: error.message @@ -157,23 +164,31 @@ processors: tag: set_event_type_from_chrome_name lang: painless params: + browser_extension_install: installation chrome_os_add_user: creation chrome_os_remove_user: deletion - device_boot_state_change: change chrome_os_login_failure_event: info chrome_os_login_logout_event: info chrome_os_login_event: start chrome_os_logout_event: end + content_transfer: info + device_boot_state_change: change extension_request: info login_event: info malware_transfer: info + password_breach: info + sensitive_data_transfer: info + unsafe_site_visit: info source: |- if (ctx.event == null) { ctx.event = new HashMap(); } - def type = new ArrayList(); - type.add(params.get(ctx.google_workspace.chrome.name.toLowerCase())); - ctx.event.put('type', type); + def type = params.get(ctx.google_workspace.chrome.name.toLowerCase()); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.put('type', [type]); + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/chrome/sample_event.json b/packages/google_workspace/data_stream/chrome/sample_event.json index eb2bdf5688b..bb8c1d4f36b 100644 --- a/packages/google_workspace/data_stream/chrome/sample_event.json +++ b/packages/google_workspace/data_stream/chrome/sample_event.json @@ -1,15 +1,15 @@ { "@timestamp": "2024-12-09T14:18:25.405Z", "agent": { - "ephemeral_id": "5e3c65b6-9b4b-4f04-adaa-cc64f98c8310", - "id": "529394dd-d27c-464d-9215-01b83c09d076", - "name": "elastic-agent-85230", + "ephemeral_id": "9fe95630-3cd8-4a6b-9284-34a97968419d", + "id": "fd20d16d-a4f3-4cf2-954f-302994a9b79a", + "name": "elastic-agent-84798", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chrome", - "namespace": "32993", + "namespace": "17212", "type": "logs" }, "device": { @@ -21,21 +21,27 @@ "version": "8.16.0" }, "elastic_agent": { - "id": "529394dd-d27c-464d-9215-01b83c09d076", + "id": "fd20d16d-a4f3-4cf2-954f-302994a9b79a", "snapshot": false, "version": "8.19.4" }, "event": { "action": "browser_extension_install", "agent_id_status": "verified", + "category": [ + "package" + ], "dataset": "google_workspace.chrome", "id": "-3640711002716937498", - "ingested": "2026-01-21T12:47:55Z", + "ingested": "2026-07-29T05:53:08Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh.kumar@example.io\",\"profileId\":\"109689693170624712102\"},\"etag\":\"\\\"CfV-pEPVZc7PJf2fWsHJTliD34MdGbO8iFIk3L4uBwQ/cBsNSJx2A9Lg8kiQCGLddmq827A\\\"\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"lmjegmlicamnimmfhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"02gajno12larrqx\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "BROWSER_EXTENSION_INSTALL" + "reason": "BROWSER_EXTENSION_INSTALL", + "type": [ + "installation" + ] }, "google_workspace": { "chrome": { @@ -93,7 +99,8 @@ "related": { "user": [ "kalpesh.kumar@example.io", - "109689693170624712102" + "109689693170624712102", + "kalpesh.kumar" ] }, "source": { diff --git a/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json b/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json index 560d8e9d61a..593b34e705e 100644 --- a/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json +++ b/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json @@ -7,12 +7,17 @@ }, "event": { "action": "ACCESS_DENY_EVENT", - "id": "-6709442587437772138", - "kind": [ - "event" + "category": [ + "network" ], + "id": "-6709442587437772138", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"etag\":\"\\\"CTyc505ppdmJR2motHVsU17kzItOkPo5vYViqlSF0rU/_JGuGElaExAZGVCsPXBMf-HkFqo\\\"\",\"events\":{\"type\":\"context_aware_access\",\"name\":\"ACCESS_DENY_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}]},\"id\":{\"applicationName\":\"token\",\"customerId\":\"C02umwv6u\",\"time\":\"2023-01-01T06:24:42.442Z\",\"uniqueQualifier\":\"-6709442587437772138\"},\"ipAddress\":\"89.160.20.112\",\"kind\":\"admin#reports#activity\"}", - "provider": "token" + "outcome": "failure", + "provider": "token", + "type": [ + "denied" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml index d21e19108a3..f2fe01fbad0 100644 --- a/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml @@ -36,9 +36,6 @@ processors: if: ctx.json?.events == null description: Discard events that are missing the target during the split operation and are subsequently returned as the root object. tag: drop_empty_events - - set: - field: event.kind - value: [event] - date: field: json.id.time if: ctx.json?.id?.time != null && ctx.json.id.time != '' @@ -333,6 +330,30 @@ processors: field: google_workspace.context_aware_access.CAA_DEVICE_STATE target_field: google_workspace.context_aware_access.device.state ignore_missing: true + - set: + field: event.kind + tag: set_event_kind + value: event + - append: + field: event.category + tag: append_network_into_event_category + value: network + if: ctx.event?.action != null && ["ACCESS_DENY_EVENT","ACCESS_DENY_INTERNAL_ERROR_EVENT","MONITOR_MODE_ACCESS_DENY_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_denied_into_event_type + value: denied + if: ctx.event?.action != null && ["ACCESS_DENY_EVENT","ACCESS_DENY_INTERNAL_ERROR_EVENT","MONITOR_MODE_ACCESS_DENY_EVENT"].contains(ctx.event.action) + - set: + field: event.outcome + tag: set_event_outcome_to_failure + value: failure + if: ctx.event?.action != null && ["ACCESS_DENY_EVENT","ACCESS_DENY_INTERNAL_ERROR_EVENT","MONITOR_MODE_ACCESS_DENY_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type + value: info + if: ctx.event?.type == null - remove: field: - json diff --git a/packages/google_workspace/data_stream/context_aware_access/sample_event.json b/packages/google_workspace/data_stream/context_aware_access/sample_event.json index ce449ad007a..61c54f27377 100644 --- a/packages/google_workspace/data_stream/context_aware_access/sample_event.json +++ b/packages/google_workspace/data_stream/context_aware_access/sample_event.json @@ -1,37 +1,38 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "98e152de-6cca-41b4-a96c-7d524ad1d520", - "id": "e28183dc-9502-4bc0-b6f9-057d8093d53f", - "name": "elastic-agent-23811", + "ephemeral_id": "2bce9511-e030-46d7-9831-d1f283b800ea", + "id": "ffe11690-540e-4299-b8cf-e77d2ba51356", + "name": "elastic-agent-87207", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.context_aware_access", - "namespace": "31084", + "namespace": "22169", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "e28183dc-9502-4bc0-b6f9-057d8093d53f", + "id": "ffe11690-540e-4299-b8cf-e77d2ba51356", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2025-12-08T04:33:03.762Z", + "created": "2026-07-29T05:54:50.248Z", "dataset": "google_workspace.context_aware_access", "id": "1", - "ingested": "2025-12-08T04:33:06Z", - "kind": [ - "event" - ], + "ingested": "2026-07-29T05:54:53Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "provider": "device", + "type": [ + "info" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json b/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json index 6d62e066bbf..f66a33a013e 100644 --- a/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json +++ b/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json @@ -7,12 +7,19 @@ }, "event": { "action": "APPLICATION_EVENT", - "id": "1", - "kind": [ - "event" + "category": [ + "host", + "package" ], + "id": "1", + "kind": "event", "original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"example.com\",\"ipAddress\":\"67.43.156.13\",\"etag\":\"string\",\"events\":{\"type\":\"device_applications\",\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}]}}", - "provider": "login" + "outcome": "failure", + "provider": "login", + "type": [ + "change", + "installation" + ] }, "google_workspace": { "actor": { @@ -171,12 +178,16 @@ }, "event": { "action": "DEVICE_SYNC_EVENT", - "id": "1", - "kind": [ - "event" + "category": [ + "host" ], + "id": "1", + "kind": "event", "original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"example.com\",\"ipAddress\":\"67.43.156.13\",\"etag\":\"string\",\"events\":{\"type\":\"device_updates\",\"name\":\"DEVICE_SYNC_EVENT\",\"parameters\":[{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"LAST_SYNC_AUDIT_DATE\",\"value\":\"1731689445476\"}]}}", - "provider": "login" + "provider": "login", + "type": [ + "info" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml index 702c27a275c..532e93d7b09 100644 --- a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml @@ -36,9 +36,6 @@ processors: if: ctx.json?.events == null description: Discard events that are missing the target during the split operation and are subsequently returned as the root object. tag: drop_empty_events - - set: - field: event.kind - value: [event] - date: field: json.id.time if: ctx.json?.id?.time != null && ctx.json.id.time != '' @@ -533,6 +530,127 @@ processors: field: google_workspace.device.WINDOWS_SYNCML_POLICY_STATUS_CODE target_field: google_workspace.device.windows_syncml_policy_status_code ignore_missing: true + - append: + field: event.category + tag: append_host_into_event_category + value: host + - set: + field: event.kind + tag: set_event_kind + value: event + - set: + field: event.kind + tag: set_event_kind_to_alert + value: alert + if: ctx.event?.action != null && ["DEVICE_COMPROMISED_EVENT", "SUSPICIOUS_ACTIVITY_EVENT"].contains(ctx.event.action) + - append: + field: event.category + tag: append_authentication_into_event_category + value: authentication + if: ctx.event?.action != null && ctx.event.action == "FAILED_PASSWORD_ATTEMPTS_EVENT" + - append: + field: event.category + tag: append_malware_into_event_category + value: malware + if: ctx.event?.action != null && ctx.event.action == "SUSPICIOUS_ACTIVITY_EVENT" + - append: + field: event.category + tag: append_threat_into_event_category + value: threat + if: ctx.event?.action != null && ["DEVICE_COMPROMISED_EVENT", "SUSPICIOUS_ACTIVITY_EVENT"].contains(ctx.event.action) + - append: + field: event.category + tag: append_package_into_event_category + value: package + if: ctx.event?.action != null && ctx.event.action == "APPLICATION_EVENT" + - append: + field: event.type + tag: append_change_into_event_type + value: change + if: ctx.event?.action != null && ["APPLICATION_EVENT", "DEVICE_ACTION_EVENT", "DEVICE_COMPLIANCE_CHANGED_EVENT", "OS_UPDATED_EVENT", "DEVICE_OWNERSHIP_CHANGE_EVENT", "DEVICE_SETTINGS_UPDATED_EVENT", "ADVANCED_POLICY_SYNC_EVENT", "RISK_SIGNAL_UPDATED_EVENT", "ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT", "APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type + value: info + if: ctx.event?.action != null && ["DEVICE_SYNC_EVENT", "APPLICATION_REPORT_EVENT", "SUSPICIOUS_ACTIVITY_EVENT", "FAILED_PASSWORD_ATTEMPTS_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_indicator_into_event_type + value: indicator + if: ctx.event?.action != null && ["DEVICE_COMPROMISED_EVENT", "SUSPICIOUS_ACTIVITY_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_start_into_event_type + value: start + if: ctx.event?.action != null && ctx.event.action == "DEVICE_REGISTER_UNREGISTER_EVENT" && ctx.google_workspace?.device?.account_state != null && ctx.google_workspace.device.account_state.equalsIgnoreCase("REGISTERED") + - append: + field: event.type + tag: append_end_into_event_type + value: end + if: ctx.event?.action != null && ctx.event.action == "DEVICE_REGISTER_UNREGISTER_EVENT" && ctx.google_workspace?.device?.account_state != null && !ctx.google_workspace.device.account_state.equalsIgnoreCase("REGISTERED") + - append: + field: event.type + tag: append_installation_into_event_type + value: installation + if: ctx.event?.action != null && ctx.event.action == "APPLICATION_EVENT" && ctx.google_workspace?.device?.application?.state != null && ctx.google_workspace.device.application.state.equalsIgnoreCase("INSTALLED") + - append: + field: event.type + tag: append_application_deletion_into_event_type + value: deletion + if: ctx.event?.action != null && ctx.event.action == "APPLICATION_EVENT" && ctx.google_workspace?.device?.application?.state != null && (ctx.google_workspace.device.application.state.equalsIgnoreCase("REMOVED") || ctx.google_workspace.device.application.state.equalsIgnoreCase("UNINSTALLED")) + - set: + field: event.outcome + tag: set_event_outcome_to_success + value: success + if: >- + ctx.google_workspace?.device?.action?.execution_status != null && + (ctx.google_workspace.device.action.execution_status.equalsIgnoreCase('SUCCESS') || + ctx.google_workspace.device.action.execution_status.equalsIgnoreCase('ACTION_SUCCESS')) + - set: + field: event.outcome + tag: set_event_outcome_to_success_from_policy_sync + value: success + if: >- + ctx.google_workspace?.device?.policy?.sync?.result != null && + ctx.google_workspace.device.policy.sync.result.equalsIgnoreCase('POLICY_SYNC_SUCCEEDED') + - set: + field: event.outcome + tag: set_event_outcome_to_success_from_compliance + value: success + if: >- + ctx.google_workspace?.device?.compliance != null && + ctx.google_workspace.device.compliance.equalsIgnoreCase('COMPLIANT') + - set: + field: event.outcome + tag: set_event_outcome_to_failure + value: failure + if: >- + ctx.google_workspace?.device?.action?.execution_status != null && + (ctx.google_workspace.device.action.execution_status.contains('REJECT') || + ctx.google_workspace.device.action.execution_status.contains('FAIL')) + - set: + field: event.outcome + tag: set_event_outcome_to_failure_from_policy_sync + value: failure + if: >- + ctx.google_workspace?.device?.policy?.sync?.result != null && + (ctx.google_workspace.device.policy.sync.result.equalsIgnoreCase('POLICY_SYNC_ABORTED') || + ctx.google_workspace.device.policy.sync.result.equalsIgnoreCase('POLICY_SYNC_FAILED')) + - set: + field: event.outcome + tag: set_event_outcome_to_failure_from_compliance + value: failure + if: >- + ctx.google_workspace?.device?.compliance != null && + ctx.google_workspace.device.compliance.equalsIgnoreCase('NON_COMPLIANT') + - set: + field: event.outcome + tag: set_event_outcome_to_failure_from_password_attempts + value: failure + if: >- + ctx.event?.action == "FAILED_PASSWORD_ATTEMPTS_EVENT" && + ctx.google_workspace?.device?.failed_passwd_attempts != null && + ctx.google_workspace.device.failed_passwd_attempts > 0 - foreach: field: user.email if: ctx.user?.email instanceof List diff --git a/packages/google_workspace/data_stream/device/sample_event.json b/packages/google_workspace/data_stream/device/sample_event.json index 3118286a812..dd2002b52f3 100644 --- a/packages/google_workspace/data_stream/device/sample_event.json +++ b/packages/google_workspace/data_stream/device/sample_event.json @@ -1,37 +1,44 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "bd04308b-2f70-430a-883a-4e7cd10123d7", - "id": "10c458fc-acd6-4cca-8d04-2263ff81c7e6", - "name": "elastic-agent-75163", + "ephemeral_id": "14e1b701-1317-425c-ba20-03919fb88569", + "id": "5c4c52d8-4476-42f6-96cc-3cc0946ae3ab", + "name": "elastic-agent-10485", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.device", - "namespace": "34729", + "namespace": "25697", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "10c458fc-acd6-4cca-8d04-2263ff81c7e6", + "id": "5c4c52d8-4476-42f6-96cc-3cc0946ae3ab", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2025-12-08T04:34:13.648Z", + "category": [ + "host", + "package" + ], + "created": "2026-07-29T05:55:46.418Z", "dataset": "google_workspace.device", "id": "1", - "ingested": "2025-12-08T04:34:16Z", - "kind": [ - "event" - ], + "ingested": "2026-07-29T05:55:49Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "outcome": "failure", + "provider": "device", + "type": [ + "change", + "installation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json b/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json index b5e0e62615d..991faf2b445 100644 --- a/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json +++ b/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json @@ -7,12 +7,16 @@ }, "event": { "action": "IMPORT_SSH_PUBLIC_KEY", - "id": "-6709442587437772138", - "kind": [ - "event" + "category": [ + "iam" ], + "id": "-6709442587437772138", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"etag\":\"\\\"CTyc505ppdmJR2motHVsU17kzItOkPo5vYViqlSF0rU/_JGuGElaExAZGVCsPXBMf-HkFqo\\\"\",\"events\":{\"type\":\"CLOUD_OSLOGIN\",\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"foo@bar.com\"}]},\"id\":{\"applicationName\":\"token\",\"customerId\":\"C02umwv6u\",\"time\":\"2023-01-01T06:24:42.442Z\",\"uniqueQualifier\":\"-6709442587437772138\"},\"ipAddress\":\"89.160.20.112\",\"kind\":\"admin#reports#activity\"}", - "provider": "token" + "provider": "token", + "type": [ + "creation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml index d78157218b8..b55c5b55d5d 100644 --- a/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml @@ -38,7 +38,8 @@ processors: tag: drop_empty_events - set: field: event.kind - value: [event] + tag: set_event_kind + value: event - date: field: json.id.time if: ctx.json?.id?.time != null && ctx.json.id.time != '' @@ -238,6 +239,36 @@ processors: value: '{{{source.user.email}}}' if: ctx.source?.user?.name != null allow_duplicates: false + - append: + field: event.category + tag: append_iam_into_event_category + value: iam + if: ctx.event?.action != null + - append: + field: event.type + tag: append_creation_into_event_type + value: creation + if: ctx.event?.action == 'IMPORT_SSH_PUBLIC_KEY' + - append: + field: event.type + tag: append_deletion_into_event_type + value: deletion + if: ctx.event?.action != null && ["DELETE_POSIX_ACCOUNT","DELETE_SSH_PUBLIC_KEY"].contains(ctx.event.action) + - append: + field: event.type + tag: append_access_into_event_type + value: access + if: ctx.event?.action != null && ["GET_SSH_PUBLIC_KEY","GET_LOGIN_PROFILE"].contains(ctx.event.action) + - append: + field: event.type + tag: append_change_into_event_type + value: change + if: ctx.event?.action == 'UPDATE_SSH_PUBLIC_KEY' + - append: + field: event.type + tag: append_info_into_event_type_for_unknown_gcp_action + value: info + if: ctx.event?.action != null && !["IMPORT_SSH_PUBLIC_KEY","DELETE_POSIX_ACCOUNT","DELETE_SSH_PUBLIC_KEY","GET_SSH_PUBLIC_KEY","GET_LOGIN_PROFILE","UPDATE_SSH_PUBLIC_KEY"].contains(ctx.event.action) - script: lang: painless description: Map Event parameters into key value pair. diff --git a/packages/google_workspace/data_stream/gcp/sample_event.json b/packages/google_workspace/data_stream/gcp/sample_event.json index e035b664391..23e830f3011 100644 --- a/packages/google_workspace/data_stream/gcp/sample_event.json +++ b/packages/google_workspace/data_stream/gcp/sample_event.json @@ -1,37 +1,41 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "0505a3b2-62e8-4aef-a980-f0528788398b", - "id": "ee5f48ab-58d5-424d-97af-ce9077453cee", - "name": "elastic-agent-76346", + "ephemeral_id": "2f60bf92-3781-4831-b19c-792f8565bbef", + "id": "25ffa2e6-eaa5-4bed-82e9-ca0ad5868dc0", + "name": "elastic-agent-57067", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.gcp", - "namespace": "72783", + "namespace": "20316", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "ee5f48ab-58d5-424d-97af-ce9077453cee", + "id": "25ffa2e6-eaa5-4bed-82e9-ca0ad5868dc0", "snapshot": false, "version": "8.19.4" }, "event": { "action": "IMPORT_SSH_PUBLIC_KEY", "agent_id_status": "verified", - "created": "2025-12-08T04:36:32.150Z", + "category": [ + "iam" + ], + "created": "2026-07-29T05:57:22.727Z", "dataset": "google_workspace.gcp", "id": "1", - "ingested": "2025-12-08T04:36:35Z", - "kind": [ - "event" - ], + "ingested": "2026-07-29T05:57:25Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"foo@bar.com\"}],\"type\":\"CLOUD_OSLOGIN\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "provider": "device", + "type": [ + "creation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json b/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json index 19cbb8846cb..11f3715930b 100644 --- a/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json +++ b/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json @@ -7,12 +7,18 @@ }, "event": { "action": "add_info_setting", - "id": "1", - "kind": [ - "event" + "category": [ + "iam", + "configuration" ], + "id": "1", + "kind": "event", "original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"etag\":\"string\",\"events\":{\"type\":\"moderator_action\",\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}]}}", - "provider": "login" + "provider": "login", + "type": [ + "group", + "creation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml index 2f09e2a7162..1008fb3553b 100644 --- a/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml @@ -36,9 +36,6 @@ processors: if: ctx.json?.events == null description: Discard events that are missing the target during the split operation and are subsequently returned as the root object. tag: drop_empty_events - - set: - field: event.kind - value: [event] - date: field: json.id.time if: ctx.json?.id?.time != null && ctx.json.id.time != '' @@ -192,6 +189,48 @@ processors: field: user.id copy_from: source.user.id ignore_empty_value: true + - append: + field: event.category + tag: append_iam_into_event_category + value: iam + - append: + field: event.type + tag: append_group_into_event_type + value: group + - set: + field: event.kind + tag: set_event_kind + value: event + - append: + field: event.category + tag: append_configuration_into_event_category + value: configuration + if: ctx.event?.action != null && ["add_info_setting", "remove_info_setting", "change_info_setting", "add_security_setting", "remove_security_setting", "change_security_setting", "change_security_setting_state", "add_service_account_permission", "remove_service_account_permission", "add_dynamic_group_query", "change_dynamic_group_query", "create_namespace", "delete_namespace"].contains(ctx.event.action) + - append: + field: event.type + tag: append_change_into_event_type + value: change + if: ctx.event?.action != null && ["change_info_setting", "change_security_setting", "change_security_setting_state", "change_dynamic_group_query", "update_membership_expiry", "approve_join_request", "join", "unban_member"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type + value: info + if: ctx.event?.action != null && ["accept_invitation", "request_to_join", "reject_invitation", "reject_join_request", "ban_member_with_moderation"].contains(ctx.event.action) + - append: + field: event.type + tag: append_user_into_event_type + value: user + if: ctx.event?.action != null && ["accept_invitation", "add_member", "remove_member", "invite_member", "join", "reject_invitation", "reject_join_request", "request_to_join", "revoke_invitation", "ban_member_with_moderation", "unban_member", "approve_join_request"].contains(ctx.event.action) + - append: + field: event.type + tag: append_creation_into_event_type + value: creation + if: ctx.event?.action != null && ["create_group", "create_namespace", "add_info_setting", "add_security_setting", "add_service_account_permission", "add_member", "add_member_role", "add_dynamic_group_query", "add_membership_expiry", "invite_member"].contains(ctx.event.action) + - append: + field: event.type + tag: append_deletion_into_event_type + value: deletion + if: ctx.event?.action != null && ["delete_group", "delete_namespace", "remove_info_setting", "remove_security_setting", "remove_service_account_permission", "remove_member", "remove_member_role", "remove_membership_expiry", "revoke_invitation"].contains(ctx.event.action) - script: lang: painless description: Extract User name and User domain from Email. diff --git a/packages/google_workspace/data_stream/group_enterprise/sample_event.json b/packages/google_workspace/data_stream/group_enterprise/sample_event.json index e06396004e3..ff24d2ec6ab 100644 --- a/packages/google_workspace/data_stream/group_enterprise/sample_event.json +++ b/packages/google_workspace/data_stream/group_enterprise/sample_event.json @@ -1,37 +1,43 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "1e96a41d-fab8-4711-b3b7-2c80d7684821", - "id": "a4ef7a22-cfd6-4e87-aaa9-ea58e64ca9b3", - "name": "elastic-agent-82451", + "ephemeral_id": "679861d5-ade4-46b9-9625-bee639c322dd", + "id": "2e034b60-759e-4978-b9d0-314065ff8fd8", + "name": "elastic-agent-96066", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.group_enterprise", - "namespace": "18098", + "namespace": "61974", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "a4ef7a22-cfd6-4e87-aaa9-ea58e64ca9b3", + "id": "2e034b60-759e-4978-b9d0-314065ff8fd8", "snapshot": false, "version": "8.19.4" }, "event": { "action": "add_info_setting", "agent_id_status": "verified", - "created": "2025-12-08T04:39:03.176Z", + "category": [ + "iam", + "configuration" + ], + "created": "2026-07-29T04:11:31.741Z", "dataset": "google_workspace.group_enterprise", "id": "1", - "ingested": "2025-12-08T04:39:06Z", - "kind": [ - "event" - ], + "ingested": "2026-07-29T04:11:34Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}],\"type\":\"moderator_action\"},\"id\":{\"applicationName\":\"group_enterprise\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "group_enterprise" + "provider": "group_enterprise", + "type": [ + "group", + "creation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log-expected.json b/packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log-expected.json index 4450f93feed..9102f8887fa 100644 --- a/packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log-expected.json +++ b/packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log-expected.json @@ -79,6 +79,9 @@ }, "event": { "action": "deleted-attachment", + "category": [ + "file" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-27T12:46:29.430Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"keep\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"deleted_attachment\", \"parameters\": [{\"name\": \"owner_email\", \"value\": \"foo@bar.com\"}, {\"name\": \"note_name\", \"value\": \"https://keep.googleapis.com/v1/notes/abc-xyz\"}, {\"name\": \"attachment_name\", \"value\": \"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}]}}", @@ -149,6 +152,9 @@ }, "event": { "action": "uploaded-attachment", + "category": [ + "file" + ], "id": "0", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-27T12:45:08.310Z\", \"uniqueQualifier\": \"0\", \"applicationName\": \"keep\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"uploaded_attachment\", \"parameters\": [{\"name\": \"owner_email\", \"value\": \"foo@bar.com\"}, {\"name\": \"note_name\", \"value\": \"https://keep.googleapis.com/v1/notes/abc-xyz\"}, {\"name\": \"attachment_name\", \"value\": \"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}]}}", diff --git a/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml index cfd801f88a3..10072a75a86 100644 --- a/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml @@ -95,9 +95,14 @@ processors: value: event - append: field: event.category - tag: set_iam_into_event_category + tag: append_iam_into_event_category value: iam if: ctx.google_workspace?.keep?.name == "modified_acl" + - append: + field: event.category + tag: append_file_into_event_category + value: file + if: ctx.google_workspace?.keep?.name != null && ["uploaded_attachment", "deleted_attachment"].contains(ctx.google_workspace.keep.name) - script: description: Set event type based on event name. if: ctx.google_workspace?.keep?.name != null @@ -112,9 +117,12 @@ processors: modified_acl: change source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.keep.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.keep.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/keep/sample_event.json b/packages/google_workspace/data_stream/keep/sample_event.json index 4f418e6140d..fbe8271ffa5 100644 --- a/packages/google_workspace/data_stream/keep/sample_event.json +++ b/packages/google_workspace/data_stream/keep/sample_event.json @@ -1,31 +1,34 @@ { "@timestamp": "2025-03-27T12:45:08.310Z", "agent": { - "ephemeral_id": "e43a76f4-47c9-40b4-b16e-547081b85cca", - "id": "d2812dfd-bd3b-46f8-b372-9357a26b4580", - "name": "elastic-agent-49635", + "ephemeral_id": "6ea4e32f-5b2f-44c5-94a1-eb8f3a056d96", + "id": "f2e914a5-6687-4f3d-8e76-23a4996e4b93", + "name": "elastic-agent-26560", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.keep", - "namespace": "61415", + "namespace": "43435", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "d2812dfd-bd3b-46f8-b372-9357a26b4580", - "snapshot": true, - "version": "8.18.0" + "id": "f2e914a5-6687-4f3d-8e76-23a4996e4b93", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "uploaded-attachment", "agent_id_status": "verified", + "category": [ + "file" + ], "dataset": "google_workspace.keep", "id": "0", - "ingested": "2025-04-29T06:58:21Z", + "ingested": "2026-07-29T05:59:04Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\",\"events\":{\"name\":\"uploaded_attachment\",\"parameters\":[{\"name\":\"owner_email\",\"value\":\"foo@bar.com\"},{\"name\":\"note_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz\"},{\"name\":\"attachment_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"keep\",\"customerId\":\"1\",\"time\":\"2025-03-27T12:45:08.310Z\",\"uniqueQualifier\":\"0\"},\"kind\":\"admin#reports#activity\"}", "provider": "keep", diff --git a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml index 628a7a2c896..f8ac1decc2f 100644 --- a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml @@ -154,7 +154,7 @@ processors: - append: field: event.category value: iam - if: '["account_disabled_password_leak","2sv_disable","2sv_enroll","account_disabled_generic","account_disabled_spamming_through_relay","account_disabled_spamming","account_disabled_hijacked","titanium_enroll","titanium_unenroll","gov_attack_warning"].contains(ctx?.event?.action)' + if: '["account_disabled_password_leak","2sv_disable","2sv_enroll","account_disabled_generic","account_disabled_spamming_through_relay","account_disabled_spamming","account_disabled_hijacked","titanium_enroll","titanium_unenroll","gov_attack_warning","passkey_enrolled","passkey_removed"].contains(ctx.event?.action)' - append: field: event.category value: configuration @@ -179,6 +179,16 @@ processors: field: event.type value: change if: '["password_edit","recovery_email_edit","recovery_phone_edit","recovery_secret_qa_edit","account_disabled_generic","account_disabled_spamming_through_relay","account_disabled_spamming","account_disabled_hijacked"].contains(ctx?.event?.action)' + - append: + field: event.type + tag: append_creation_into_event_type_for_passkey_enrolled + value: creation + if: ctx.event?.action == 'passkey_enrolled' + - append: + field: event.type + tag: append_deletion_into_event_type_for_passkey_removed + value: deletion + if: ctx.event?.action == 'passkey_removed' - append: field: event.type value: info diff --git a/packages/google_workspace/data_stream/login/sample_event.json b/packages/google_workspace/data_stream/login/sample_event.json index a273f6d8d22..27fd41d24c1 100644 --- a/packages/google_workspace/data_stream/login/sample_event.json +++ b/packages/google_workspace/data_stream/login/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2022-05-04T15:04:05.000Z", "agent": { - "ephemeral_id": "6bfca960-9021-4a33-b298-1b6854b1e312", - "id": "5b3e320e-19d9-4dd3-9df2-ac99d545b1c5", - "name": "elastic-agent-45845", + "ephemeral_id": "bed60d5c-4818-4532-b154-8552a207963d", + "id": "216537c1-0624-4a33-8211-e63900f3f8ea", + "name": "elastic-agent-60367", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.login", - "namespace": "27499", + "namespace": "74725", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "5b3e320e-19d9-4dd3-9df2-ac99d545b1c5", + "id": "216537c1-0624-4a33-8211-e63900f3f8ea", "snapshot": false, "version": "8.19.4" }, @@ -26,10 +26,10 @@ "category": [ "iam" ], - "created": "2025-12-08T05:12:21.961Z", + "created": "2026-07-29T06:00:06.077Z", "dataset": "google_workspace.login", "id": "1", - "ingested": "2025-12-08T05:12:24Z", + "ingested": "2026-07-29T06:00:09Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "login", diff --git a/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml index 33cc2547df2..5e2b6aa6e8a 100644 --- a/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml @@ -95,9 +95,9 @@ processors: value: event - append: field: event.category - tag: set_network_into_event_category + tag: append_network_into_event_category value: network - if: ctx.google_workspace?.meet?.name != null && ctx.google_workspace.meet.name == "call_ended" + if: '["call_ended","dialed_out","ring_sent","ring_answered","ring_missed"].contains(ctx.google_workspace?.meet?.name)' - script: description: Set event type based on event name. if: ctx.google_workspace?.meet?.name != null @@ -107,22 +107,38 @@ processors: abuse_report_submitted: info broadcast_activity: info call_ended: info - livestream_watched: info + closed_captions_started: info + consented_to_third_party_media_app: info dialed_out: info + hand_raised: info in_meet_broadcast_activity: info invitation_sent: info knocking_accepted: info knocking_denied: info + livestream_watched: info poll_answered: info poll_created: creation presentation_started: info presentation_stopped: info question_created: creation question_responded: info + reaction_sent: info recording_activity: info ring_answered: info ring_missed: info ring_sent: info + room_check_in: info + room_check_out: info + see_chat_everyone: info + see_chat_participants: info + send_chat_contributors: info + send_chat_everyone: info + send_chat_hosts: info + smart_notes_session_started: info + smart_notes_session_stopped: info + speech_translation_allowed: info + speech_translation_disallowed: info + streaming_session_explicit_consent: info transcription_activity: info watermarking_active: info watermarking_starting: info @@ -130,9 +146,12 @@ processors: whiteboard_started: info source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.meet.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.meet.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/meet/sample_event.json b/packages/google_workspace/data_stream/meet/sample_event.json index 5e9bf23ce76..d9a1cf45303 100644 --- a/packages/google_workspace/data_stream/meet/sample_event.json +++ b/packages/google_workspace/data_stream/meet/sample_event.json @@ -1,31 +1,31 @@ { "@timestamp": "2025-04-11T09:23:00.703059Z", "agent": { - "ephemeral_id": "7a575721-1942-4427-82ec-22448e27a2d1", - "id": "eb41b16b-f309-4682-9d3a-30342d680fe9", - "name": "elastic-agent-32126", + "ephemeral_id": "aebece6a-1925-414e-a7e3-a86ced5bac7d", + "id": "a71b149d-2a6e-4e68-9259-193c896269fb", + "name": "elastic-agent-94649", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.meet", - "namespace": "56950", + "namespace": "85335", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "eb41b16b-f309-4682-9d3a-30342d680fe9", - "snapshot": true, - "version": "8.18.0" + "id": "a71b149d-2a6e-4e68-9259-193c896269fb", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "invitation-sent", "agent_id_status": "verified", "dataset": "google_workspace.meet", "id": "1", - "ingested": "2025-05-05T10:30:54Z", + "ingested": "2026-07-29T06:01:09Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"invitation_sent\",\"parameters\":[{\"boolValue\":false,\"name\":\"is_external\"},{\"name\":\"meeting_code\",\"value\":\"NTBTYDTXBE\"},{\"name\":\"conference_id\",\"value\":\"-PeisjX_5iUtKPuGffkJDaBcdEfgh\"},{\"name\":\"action_time\",\"value\":\"2025-04-11T09:23:00.703059Z\"},{\"intValue\":\"1\",\"name\":\"target_user_count\"},{\"name\":\"identifier\",\"value\":\"foo@bar.com\"},{\"name\":\"identifier_type\",\"value\":\"email_address\"}],\"type\":\"conference_action\"},\"id\":{\"applicationName\":\"meet\",\"customerId\":\"1\",\"time\":\"2025-04-11T09:23:00.703Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "meet", diff --git a/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json b/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json index 48166a0954c..dcf10883308 100644 --- a/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json +++ b/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json @@ -7,10 +7,16 @@ }, "event": { "action": "rule_match", + "category": [ + "intrusion_detection" + ], "id": "1", - "kind": "event", + "kind": "alert", "original": "{\"kind\":\"admin#reports#activity\",\"etag\":\"Etag\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"rules\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"example.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"rule_match_type\",\"name\":\"rule_match\",\"parameters\":[{\"name\":\"has_alert\",\"boolValue\":\"true\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"name\":\"resource_recipients_omitted_count\",\"intValue\":\"1234\"},{\"name\":\"resource_recipients\",\"multiValue\":[\"bar@bar.com\",\"foo@example.com\",\"foo@foo.com\"]},{\"name\":\"rule_name\",\"multiValue\":[\"managers\"]},{\"name\":\"rule_id\",\"multiIntValue\":[\"12\"]}]}}", - "provider": "rules" + "provider": "rules", + "type": [ + "info" + ] }, "google_workspace": { "actor": { @@ -121,10 +127,16 @@ }, "event": { "action": "rule_match", + "category": [ + "intrusion_detection" + ], "id": "1", - "kind": "event", + "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-11-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", - "provider": "rules" + "provider": "rules", + "type": [ + "info" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml index 1270097429b..5687fdfa35f 100644 --- a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml @@ -206,9 +206,6 @@ processors: if: ctx.source?.user?.name != null allow_duplicates: false ignore_failure: true - - set: - field: event.kind - value: event - script: lang: painless description: Map Event parameters into key value pair. @@ -503,6 +500,35 @@ processors: if: ctx.google_workspace?.rules?.actor_ip_address != null allow_duplicates: false ignore_failure: true + - set: + field: event.kind + tag: set_event_kind + value: event + - append: + field: event.category + tag: append_intrusion_detection_into_event_category_for_rule_events + value: intrusion_detection + if: ctx.event?.action != null && ["rule_match","rule_trigger","action_complete"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type_for_rule_events + value: info + if: ctx.event?.action != null && ["rule_match","rule_trigger","action_complete"].contains(ctx.event.action) + - append: + field: event.type + tag: append_change_into_event_type_for_label_events + value: change + if: ctx.event?.action != null && ["label_applied","label_field_value_changed"].contains(ctx.event.action) + - append: + field: event.type + tag: append_deletion_into_event_type_for_label_removed + value: deletion + if: ctx.event?.action == 'label_removed' + - set: + field: event.kind + tag: set_event_kind_to_alert + value: alert + if: ctx.google_workspace?.rules?.has_alert == true - remove: field: - json diff --git a/packages/google_workspace/data_stream/rules/sample_event.json b/packages/google_workspace/data_stream/rules/sample_event.json index fe2b2ddca8a..a11ad635578 100644 --- a/packages/google_workspace/data_stream/rules/sample_event.json +++ b/packages/google_workspace/data_stream/rules/sample_event.json @@ -1,35 +1,41 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "afeffc94-1ad8-47d1-8fcf-40e838558833", - "id": "aace98bd-8a95-4d13-a919-0a9d6f7f8093", - "name": "elastic-agent-65365", + "ephemeral_id": "6dd44921-df3e-4058-b8a7-f864acac8e0f", + "id": "901c8bf0-0fa4-4132-a0be-09269156a5fc", + "name": "elastic-agent-91966", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.rules", - "namespace": "63851", + "namespace": "89516", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "aace98bd-8a95-4d13-a919-0a9d6f7f8093", + "id": "901c8bf0-0fa4-4132-a0be-09269156a5fc", "snapshot": false, "version": "8.19.4" }, "event": { "action": "rule_match", "agent_id_status": "verified", - "created": "2025-12-08T05:13:21.070Z", + "category": [ + "intrusion_detection" + ], + "created": "2026-07-29T06:02:52.451Z", "dataset": "google_workspace.rules", "id": "1", - "ingested": "2025-12-08T05:13:24Z", - "kind": "event", + "ingested": "2026-07-29T06:02:55Z", + "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", - "provider": "rules" + "provider": "rules", + "type": [ + "info" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/vault/_dev/test/pipeline/test-vault.log-expected.json b/packages/google_workspace/data_stream/vault/_dev/test/pipeline/test-vault.log-expected.json index 38f56dcd0b8..7b9796409fe 100644 --- a/packages/google_workspace/data_stream/vault/_dev/test/pipeline/test-vault.log-expected.json +++ b/packages/google_workspace/data_stream/vault/_dev/test/pipeline/test-vault.log-expected.json @@ -7,6 +7,9 @@ }, "event": { "action": "export", + "category": [ + "file" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-04-10T19:06:06.187Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"vault\", \"customerId\": \"1\"}, \"etag\": \"XB4Sd9ZEYpFd-msikcPTLY7Ao7PvyP0QeR9k5OdWZ_Y/9-plyixf2zhrQhgHCQ7-_gbusr4\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"export\", \"parameters\": [{\"name\": \"matter_id\", \"value\": \"123456789-73d5-4b01-ae1a-abcdefgh\"}, {\"name\": \"additional_details\", \"value\": \"export_name: \\\"Export\\\"\\nquery: \\\"( from:google.com )\\\"\\ntype: \\\"EMAIL\\\"\\nexport_format: MBOX\\ndata_region: \\\"United States\\\"\\nshow_locker_content: true\\nuse_improved_export: true\\nexport_linked_drive_files: true\\n\"}, {\"name\": \"query\", \"value\": \"mode: All data, type: Mail, terms: from:google.com, Time zone: America/Los_Angeles, \"}]}}", diff --git a/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml index 1a91d9035c9..a944e52b56c 100644 --- a/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml @@ -176,11 +176,21 @@ processors: view_retention_policy: configuration view_retention_settings: configuration view_system_audit_log: configuration + download_count_per_account_csv: file + export: file + export_file_download: file + legacy_export_download: file + view_document: file + view_document_information: file + view_external_document: file source: |- ctx.event = ctx.event ?: [:]; - def category = []; - category.add(params.get(ctx.google_workspace.vault.name)); - ctx.event.category = category; + def category = params.get(ctx.google_workspace.vault.name); + if (category == null) { + ctx.event.remove('category'); + } else { + ctx.event.category = [category]; + } on_failure: - append: field: error.message @@ -280,9 +290,12 @@ processors: view_system_audit_log: access source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.vault.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.vault.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/vault/sample_event.json b/packages/google_workspace/data_stream/vault/sample_event.json index 396fe75624f..35e4cd43c00 100644 --- a/packages/google_workspace/data_stream/vault/sample_event.json +++ b/packages/google_workspace/data_stream/vault/sample_event.json @@ -1,24 +1,24 @@ { "@timestamp": "2025-04-10T19:05:24.881Z", "agent": { - "ephemeral_id": "540f8dff-4158-4152-a7b6-757f8019ae43", - "id": "e5b82ff4-853f-4f9f-9a68-54de01dc5631", - "name": "elastic-agent-58720", + "ephemeral_id": "e1803727-09c8-4f8f-a00a-cfa7709d01d1", + "id": "92d544af-344c-4617-9be3-355dedc2955f", + "name": "elastic-agent-51926", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.vault", - "namespace": "52776", + "namespace": "16076", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "e5b82ff4-853f-4f9f-9a68-54de01dc5631", - "snapshot": true, - "version": "8.18.0" + "id": "92d544af-344c-4617-9be3-355dedc2955f", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "view-per-matter-litigation-hold-report", @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.vault", "id": "1", - "ingested": "2025-04-23T06:26:01Z", + "ingested": "2026-07-29T06:04:35Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"XB4Sd9ZEYpFd-msikcPTLY7Ao7PvyP0QeR9k5OdWZ_Y/77VsZvNcux1EnUIu_SyN08-cHo8\",\"events\":{\"name\":\"view_per_matter_litigation_hold_report\",\"parameters\":[{\"name\":\"matter_id\",\"value\":\"78504485-73d5-4b01-ae1a-63ebc1ae66eb\"},{\"name\":\"resource_name\",\"value\":\"0\"},{\"name\":\"additional_details\",\"value\":\"matter_name: \\\"Demo\\\"\\n\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"vault\",\"customerId\":\"1\",\"time\":\"2025-04-10T19:05:24.881Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "vault", diff --git a/packages/google_workspace/docs/README.md b/packages/google_workspace/docs/README.md index ff77464cf7d..9434a63f27d 100644 --- a/packages/google_workspace/docs/README.md +++ b/packages/google_workspace/docs/README.md @@ -524,22 +524,22 @@ An example event for `login` looks as following: { "@timestamp": "2022-05-04T15:04:05.000Z", "agent": { - "ephemeral_id": "6bfca960-9021-4a33-b298-1b6854b1e312", - "id": "5b3e320e-19d9-4dd3-9df2-ac99d545b1c5", - "name": "elastic-agent-45845", + "ephemeral_id": "bed60d5c-4818-4532-b154-8552a207963d", + "id": "216537c1-0624-4a33-8211-e63900f3f8ea", + "name": "elastic-agent-60367", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.login", - "namespace": "27499", + "namespace": "74725", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "5b3e320e-19d9-4dd3-9df2-ac99d545b1c5", + "id": "216537c1-0624-4a33-8211-e63900f3f8ea", "snapshot": false, "version": "8.19.4" }, @@ -549,10 +549,10 @@ An example event for `login` looks as following: "category": [ "iam" ], - "created": "2025-12-08T05:12:21.961Z", + "created": "2026-07-29T06:00:06.077Z", "dataset": "google_workspace.login", "id": "1", - "ingested": "2025-12-08T05:12:24Z", + "ingested": "2026-07-29T06:00:09Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "login", @@ -666,35 +666,41 @@ An example event for `rules` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "afeffc94-1ad8-47d1-8fcf-40e838558833", - "id": "aace98bd-8a95-4d13-a919-0a9d6f7f8093", - "name": "elastic-agent-65365", + "ephemeral_id": "6dd44921-df3e-4058-b8a7-f864acac8e0f", + "id": "901c8bf0-0fa4-4132-a0be-09269156a5fc", + "name": "elastic-agent-91966", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.rules", - "namespace": "63851", + "namespace": "89516", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "aace98bd-8a95-4d13-a919-0a9d6f7f8093", + "id": "901c8bf0-0fa4-4132-a0be-09269156a5fc", "snapshot": false, "version": "8.19.4" }, "event": { "action": "rule_match", "agent_id_status": "verified", - "created": "2025-12-08T05:13:21.070Z", + "category": [ + "intrusion_detection" + ], + "created": "2026-07-29T06:02:52.451Z", "dataset": "google_workspace.rules", "id": "1", - "ingested": "2025-12-08T05:13:24Z", - "kind": "event", + "ingested": "2026-07-29T06:02:55Z", + "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", - "provider": "rules" + "provider": "rules", + "type": [ + "info" + ] }, "google_workspace": { "actor": { @@ -1765,37 +1771,44 @@ An example event for `device` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "bd04308b-2f70-430a-883a-4e7cd10123d7", - "id": "10c458fc-acd6-4cca-8d04-2263ff81c7e6", - "name": "elastic-agent-75163", + "ephemeral_id": "14e1b701-1317-425c-ba20-03919fb88569", + "id": "5c4c52d8-4476-42f6-96cc-3cc0946ae3ab", + "name": "elastic-agent-10485", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.device", - "namespace": "34729", + "namespace": "25697", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "10c458fc-acd6-4cca-8d04-2263ff81c7e6", + "id": "5c4c52d8-4476-42f6-96cc-3cc0946ae3ab", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2025-12-08T04:34:13.648Z", + "category": [ + "host", + "package" + ], + "created": "2026-07-29T05:55:46.418Z", "dataset": "google_workspace.device", "id": "1", - "ingested": "2025-12-08T04:34:16Z", - "kind": [ - "event" - ], + "ingested": "2026-07-29T05:55:49Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "outcome": "failure", + "provider": "device", + "type": [ + "change", + "installation" + ] }, "google_workspace": { "actor": { @@ -2036,37 +2049,43 @@ An example event for `group_enterprise` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "1e96a41d-fab8-4711-b3b7-2c80d7684821", - "id": "a4ef7a22-cfd6-4e87-aaa9-ea58e64ca9b3", - "name": "elastic-agent-82451", + "ephemeral_id": "679861d5-ade4-46b9-9625-bee639c322dd", + "id": "2e034b60-759e-4978-b9d0-314065ff8fd8", + "name": "elastic-agent-96066", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.group_enterprise", - "namespace": "18098", + "namespace": "61974", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "a4ef7a22-cfd6-4e87-aaa9-ea58e64ca9b3", + "id": "2e034b60-759e-4978-b9d0-314065ff8fd8", "snapshot": false, "version": "8.19.4" }, "event": { "action": "add_info_setting", "agent_id_status": "verified", - "created": "2025-12-08T04:39:03.176Z", + "category": [ + "iam", + "configuration" + ], + "created": "2026-07-29T04:11:31.741Z", "dataset": "google_workspace.group_enterprise", "id": "1", - "ingested": "2025-12-08T04:39:06Z", - "kind": [ - "event" - ], + "ingested": "2026-07-29T04:11:34Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}],\"type\":\"moderator_action\"},\"id\":{\"applicationName\":\"group_enterprise\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "group_enterprise" + "provider": "group_enterprise", + "type": [ + "group", + "creation" + ] }, "google_workspace": { "actor": { @@ -2625,37 +2644,38 @@ An example event for `context_aware_access` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "98e152de-6cca-41b4-a96c-7d524ad1d520", - "id": "e28183dc-9502-4bc0-b6f9-057d8093d53f", - "name": "elastic-agent-23811", + "ephemeral_id": "2bce9511-e030-46d7-9831-d1f283b800ea", + "id": "ffe11690-540e-4299-b8cf-e77d2ba51356", + "name": "elastic-agent-87207", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.context_aware_access", - "namespace": "31084", + "namespace": "22169", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "e28183dc-9502-4bc0-b6f9-057d8093d53f", + "id": "ffe11690-540e-4299-b8cf-e77d2ba51356", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2025-12-08T04:33:03.762Z", + "created": "2026-07-29T05:54:50.248Z", "dataset": "google_workspace.context_aware_access", "id": "1", - "ingested": "2025-12-08T04:33:06Z", - "kind": [ - "event" - ], + "ingested": "2026-07-29T05:54:53Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "provider": "device", + "type": [ + "info" + ] }, "google_workspace": { "actor": { @@ -2795,37 +2815,41 @@ An example event for `gcp` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "0505a3b2-62e8-4aef-a980-f0528788398b", - "id": "ee5f48ab-58d5-424d-97af-ce9077453cee", - "name": "elastic-agent-76346", + "ephemeral_id": "2f60bf92-3781-4831-b19c-792f8565bbef", + "id": "25ffa2e6-eaa5-4bed-82e9-ca0ad5868dc0", + "name": "elastic-agent-57067", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.gcp", - "namespace": "72783", + "namespace": "20316", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "ee5f48ab-58d5-424d-97af-ce9077453cee", + "id": "25ffa2e6-eaa5-4bed-82e9-ca0ad5868dc0", "snapshot": false, "version": "8.19.4" }, "event": { "action": "IMPORT_SSH_PUBLIC_KEY", "agent_id_status": "verified", - "created": "2025-12-08T04:36:32.150Z", + "category": [ + "iam" + ], + "created": "2026-07-29T05:57:22.727Z", "dataset": "google_workspace.gcp", "id": "1", - "ingested": "2025-12-08T04:36:35Z", - "kind": [ - "event" - ], + "ingested": "2026-07-29T05:57:25Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"foo@bar.com\"}],\"type\":\"CLOUD_OSLOGIN\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "provider": "device", + "type": [ + "creation" + ] }, "google_workspace": { "actor": { @@ -2951,15 +2975,15 @@ An example event for `chrome` looks as following: { "@timestamp": "2024-12-09T14:18:25.405Z", "agent": { - "ephemeral_id": "5e3c65b6-9b4b-4f04-adaa-cc64f98c8310", - "id": "529394dd-d27c-464d-9215-01b83c09d076", - "name": "elastic-agent-85230", + "ephemeral_id": "9fe95630-3cd8-4a6b-9284-34a97968419d", + "id": "fd20d16d-a4f3-4cf2-954f-302994a9b79a", + "name": "elastic-agent-84798", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chrome", - "namespace": "32993", + "namespace": "17212", "type": "logs" }, "device": { @@ -2971,21 +2995,27 @@ An example event for `chrome` looks as following: "version": "8.16.0" }, "elastic_agent": { - "id": "529394dd-d27c-464d-9215-01b83c09d076", + "id": "fd20d16d-a4f3-4cf2-954f-302994a9b79a", "snapshot": false, "version": "8.19.4" }, "event": { "action": "browser_extension_install", "agent_id_status": "verified", + "category": [ + "package" + ], "dataset": "google_workspace.chrome", "id": "-3640711002716937498", - "ingested": "2026-01-21T12:47:55Z", + "ingested": "2026-07-29T05:53:08Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh.kumar@example.io\",\"profileId\":\"109689693170624712102\"},\"etag\":\"\\\"CfV-pEPVZc7PJf2fWsHJTliD34MdGbO8iFIk3L4uBwQ/cBsNSJx2A9Lg8kiQCGLddmq827A\\\"\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"lmjegmlicamnimmfhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"02gajno12larrqx\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "BROWSER_EXTENSION_INSTALL" + "reason": "BROWSER_EXTENSION_INSTALL", + "type": [ + "installation" + ] }, "google_workspace": { "chrome": { @@ -3043,7 +3073,8 @@ An example event for `chrome` looks as following: "related": { "user": [ "kalpesh.kumar@example.io", - "109689693170624712102" + "109689693170624712102", + "kalpesh.kumar" ] }, "source": { @@ -3334,24 +3365,24 @@ An example event for `calendar` looks as following: { "@timestamp": "2025-04-01T07:00:40.262Z", "agent": { - "ephemeral_id": "c496161a-177e-4359-8324-e11405aeeaad", - "id": "1ab21f00-c503-4805-b1de-01dacd186aef", - "name": "elastic-agent-44155", + "ephemeral_id": "0bf0c46e-128f-4c5f-9ef3-be0324853874", + "id": "84d83968-c050-49a6-a9f8-d1430810bcdc", + "name": "elastic-agent-49212", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.calendar", - "namespace": "50432", + "namespace": "66608", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "1ab21f00-c503-4805-b1de-01dacd186aef", - "snapshot": true, - "version": "8.18.0" + "id": "84d83968-c050-49a6-a9f8-d1430810bcdc", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "delete-calendar", @@ -3361,7 +3392,7 @@ An example event for `calendar` looks as following: ], "dataset": "google_workspace.calendar", "id": "1", - "ingested": "2025-04-22T12:01:05Z", + "ingested": "2026-07-29T05:49:29Z", "kind": "event", "original": "{\"actor\":{\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"delete_calendar\",\"parameters\":[{\"name\":\"calendar_id\",\"value\":\"c_abc123@group.calendar.google.com\"},{\"name\":\"api_kind\",\"value\":\"web\"},{\"name\":\"user_agent\",\"value\":\"Mozilla/5.0\"}],\"type\":\"calendar_change\"},\"id\":{\"applicationName\":\"calendar\",\"customerId\":\"1\",\"time\":\"2025-04-01T07:00:40.262Z\",\"uniqueQualifier\":\"1\"},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "calendar", @@ -3511,24 +3542,24 @@ An example event for `chat` looks as following: { "@timestamp": "2025-03-26T05:55:02.063Z", "agent": { - "ephemeral_id": "afc7ce98-0520-45e0-94c4-64274b308642", - "id": "411b5487-ebfa-4a91-89da-d7e59f3f1cd2", - "name": "elastic-agent-11706", + "ephemeral_id": "aaf2abc8-196a-4187-b608-1f0a3cb6d0da", + "id": "bbe3c33a-56b4-4151-a0af-5a101bfb9189", + "name": "elastic-agent-33417", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chat", - "namespace": "37789", + "namespace": "83717", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "411b5487-ebfa-4a91-89da-d7e59f3f1cd2", - "snapshot": true, - "version": "8.18.0" + "id": "bbe3c33a-56b4-4151-a0af-5a101bfb9189", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "room-name-updated", @@ -3538,7 +3569,7 @@ An example event for `chat` looks as following: ], "dataset": "google_workspace.chat", "id": "1", - "ingested": "2025-04-16T08:53:19Z", + "ingested": "2026-07-29T05:51:24Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\",\"events\":{\"name\":\"room_name_updated\",\"parameters\":[{\"name\":\"room_id\",\"value\":\"1\"},{\"name\":\"actor\",\"value\":\"foo@bar.com\"},{\"name\":\"room_name\",\"value\":\"TEST3\"},{\"name\":\"external_room\",\"value\":\"DISABLED\"},{\"name\":\"actor_type\",\"value\":\"NON_ADMIN\"},{\"name\":\"conversation_type\",\"value\":\"SPACE\"},{\"name\":\"conversation_ownership\",\"value\":\"INTERNALLY_OWNED\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"chat\",\"customerId\":\"1\",\"time\":\"2025-03-26T05:55:02.063Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "chat", @@ -3660,24 +3691,24 @@ An example event for `vault` looks as following: { "@timestamp": "2025-04-10T19:05:24.881Z", "agent": { - "ephemeral_id": "540f8dff-4158-4152-a7b6-757f8019ae43", - "id": "e5b82ff4-853f-4f9f-9a68-54de01dc5631", - "name": "elastic-agent-58720", + "ephemeral_id": "e1803727-09c8-4f8f-a00a-cfa7709d01d1", + "id": "92d544af-344c-4617-9be3-355dedc2955f", + "name": "elastic-agent-51926", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.vault", - "namespace": "52776", + "namespace": "16076", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "e5b82ff4-853f-4f9f-9a68-54de01dc5631", - "snapshot": true, - "version": "8.18.0" + "id": "92d544af-344c-4617-9be3-355dedc2955f", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "view-per-matter-litigation-hold-report", @@ -3687,7 +3718,7 @@ An example event for `vault` looks as following: ], "dataset": "google_workspace.vault", "id": "1", - "ingested": "2025-04-23T06:26:01Z", + "ingested": "2026-07-29T06:04:35Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"XB4Sd9ZEYpFd-msikcPTLY7Ao7PvyP0QeR9k5OdWZ_Y/77VsZvNcux1EnUIu_SyN08-cHo8\",\"events\":{\"name\":\"view_per_matter_litigation_hold_report\",\"parameters\":[{\"name\":\"matter_id\",\"value\":\"78504485-73d5-4b01-ae1a-63ebc1ae66eb\"},{\"name\":\"resource_name\",\"value\":\"0\"},{\"name\":\"additional_details\",\"value\":\"matter_name: \\\"Demo\\\"\\n\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"vault\",\"customerId\":\"1\",\"time\":\"2025-04-10T19:05:24.881Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "vault", @@ -3809,31 +3840,31 @@ An example event for `meet` looks as following: { "@timestamp": "2025-04-11T09:23:00.703059Z", "agent": { - "ephemeral_id": "7a575721-1942-4427-82ec-22448e27a2d1", - "id": "eb41b16b-f309-4682-9d3a-30342d680fe9", - "name": "elastic-agent-32126", + "ephemeral_id": "aebece6a-1925-414e-a7e3-a86ced5bac7d", + "id": "a71b149d-2a6e-4e68-9259-193c896269fb", + "name": "elastic-agent-94649", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.meet", - "namespace": "56950", + "namespace": "85335", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "eb41b16b-f309-4682-9d3a-30342d680fe9", - "snapshot": true, - "version": "8.18.0" + "id": "a71b149d-2a6e-4e68-9259-193c896269fb", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "invitation-sent", "agent_id_status": "verified", "dataset": "google_workspace.meet", "id": "1", - "ingested": "2025-05-05T10:30:54Z", + "ingested": "2026-07-29T06:01:09Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"invitation_sent\",\"parameters\":[{\"boolValue\":false,\"name\":\"is_external\"},{\"name\":\"meeting_code\",\"value\":\"NTBTYDTXBE\"},{\"name\":\"conference_id\",\"value\":\"-PeisjX_5iUtKPuGffkJDaBcdEfgh\"},{\"name\":\"action_time\",\"value\":\"2025-04-11T09:23:00.703059Z\"},{\"intValue\":\"1\",\"name\":\"target_user_count\"},{\"name\":\"identifier\",\"value\":\"foo@bar.com\"},{\"name\":\"identifier_type\",\"value\":\"email_address\"}],\"type\":\"conference_action\"},\"id\":{\"applicationName\":\"meet\",\"customerId\":\"1\",\"time\":\"2025-04-11T09:23:00.703Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "meet", @@ -4009,31 +4040,34 @@ An example event for `keep` looks as following: { "@timestamp": "2025-03-27T12:45:08.310Z", "agent": { - "ephemeral_id": "e43a76f4-47c9-40b4-b16e-547081b85cca", - "id": "d2812dfd-bd3b-46f8-b372-9357a26b4580", - "name": "elastic-agent-49635", + "ephemeral_id": "6ea4e32f-5b2f-44c5-94a1-eb8f3a056d96", + "id": "f2e914a5-6687-4f3d-8e76-23a4996e4b93", + "name": "elastic-agent-26560", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.keep", - "namespace": "61415", + "namespace": "43435", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "d2812dfd-bd3b-46f8-b372-9357a26b4580", - "snapshot": true, - "version": "8.18.0" + "id": "f2e914a5-6687-4f3d-8e76-23a4996e4b93", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "uploaded-attachment", "agent_id_status": "verified", + "category": [ + "file" + ], "dataset": "google_workspace.keep", "id": "0", - "ingested": "2025-04-29T06:58:21Z", + "ingested": "2026-07-29T05:59:04Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\",\"events\":{\"name\":\"uploaded_attachment\",\"parameters\":[{\"name\":\"owner_email\",\"value\":\"foo@bar.com\"},{\"name\":\"note_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz\"},{\"name\":\"attachment_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"keep\",\"customerId\":\"1\",\"time\":\"2025-03-27T12:45:08.310Z\",\"uniqueQualifier\":\"0\"},\"kind\":\"admin#reports#activity\"}", "provider": "keep", diff --git a/packages/google_workspace/manifest.yml b/packages/google_workspace/manifest.yml index 406b8138e35..a8d041f26aa 100644 --- a/packages/google_workspace/manifest.yml +++ b/packages/google_workspace/manifest.yml @@ -1,6 +1,6 @@ name: google_workspace title: Google Workspace -version: "3.5.1" +version: "3.5.2" source: license: Elastic-2.0 description: Collect logs from Google Workspace with Elastic Agent. diff --git a/packages/jamf_pro/changelog.yml b/packages/jamf_pro/changelog.yml index b308252030c..84009717de9 100644 --- a/packages/jamf_pro/changelog.yml +++ b/packages/jamf_pro/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.3.1" + changes: + - description: Add ECS event categorization fields to the events data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/20276 - version: "1.3.0" changes: - description: Enable Agentless deployment. diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json index fd627f116ba..6cbb4d4634b 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "ComputerAdded", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-check-in.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-check-in.json-expected.json index 63554a42b95..05a148dff08 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-check-in.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-check-in.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "ComputerCheckIn", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-inventory-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-inventory-completed.json-expected.json index 73b15cb6e10..b5555c254ee 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-inventory-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-inventory-completed.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "ComputerInventoryCompleted", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json index bdd10571f03..7d6ee631058 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "ComputerPatchPolicyCompleted", - "kind": "event" + "category": [ + "configuration", + "package" + ], + "kind": "event", + "outcome": "success", + "type": [ + "change" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json index 1e420e32daa..c015c7f3db2 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "ComputerPolicyFinished", - "kind": "event" + "category": [ + "configuration" + ], + "kind": "event", + "outcome": "success", + "type": [ + "change" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json index 12cfd832643..a933c0ec017 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "ComputerPushCapabilityChanged", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json index 494b40bcd03..bb65acb16a0 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "DeviceAddedToDEP", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json index b8a3aba7d05..b7552fab360 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "JSSShutdown", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "end" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json index 307dd93208b..e16681fd161 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "JSSStartup", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "start" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-check-in.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-check-in.json-expected.json index 0d6f65d2b17..42ae340bd66 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-check-in.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-check-in.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "MobileDeviceCheckIn", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json index 55b2aeb8645..f6d3e710ac2 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "MobileDeviceCommandCompleted", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "end" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json index 62b04117ce8..41d3468c5e7 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "MobileDeviceEnrolled", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "start" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-inventory-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-inventory-completed.json-expected.json index 9be8a3c922f..56d5acf5fa8 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-inventory-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-inventory-completed.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "MobileDeviceInventoryCompleted", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-push-sent.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-push-sent.json-expected.json index ffe21c5521b..d2e911e9bd2 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-push-sent.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-push-sent.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "MobileDevicePushSent", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json index e4c29088ec2..3c5689d49dd 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "MobileDeviceUnEnrolled", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "end" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json index 7f7690502fa..547dc605134 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "PatchSoftwareTitleUpdated", - "kind": "event" + "category": [ + "configuration", + "package" + ], + "kind": "event", + "type": [ + "change" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-push-sent.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-push-sent.json-expected.json index bed623ad05b..134eb6d7c22 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-push-sent.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-push-sent.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "PushSent", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json index a9f9dbd01b5..93116ffe303 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "RestAPIOperation", - "kind": "event" + "category": [ + "api" + ], + "kind": "event", + "outcome": "success", + "type": [ + "change", + "admin" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json index c6b198c2a7d..f3d030bb84d 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "SCEPChallenge", - "kind": "event" + "category": [ + "host", + "authentication" + ], + "kind": "event", + "type": [ + "start" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json index 6aaaa3b4c10..558f84045d4 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "SmartGroupComputerMembershipChange", - "kind": "event" + "category": [ + "host", + "iam" + ], + "kind": "event", + "type": [ + "change", + "group" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json index a3553fc08fa..6924645cd2b 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "SmartGroupMobileDeviceMembershipChange", - "kind": "event" + "category": [ + "host", + "iam" + ], + "kind": "event", + "type": [ + "change", + "group" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json index d6e83619d3a..7a67b4d679d 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "SmartGroupUserMembershipChange", - "kind": "event" + "category": [ + "iam" + ], + "kind": "event", + "type": [ + "change", + "group" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml index dd51553df6a..b3e3201044d 100644 --- a/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -182,6 +182,69 @@ processors: copy_from: jamf_pro.events.webhook.webhook_event ignore_empty_value: true +# event.category and event.type — keyed on event.action via a lookup table. +- script: + tag: script_set_event_category_and_type + lang: painless + description: Set event.category and event.type from a table keyed on the Jamf webhook event (event.action). + params: + actions: + ComputerAdded: { category: [host], type: [change] } + ComputerCheckIn: { category: [host], type: [] } + ComputerInventoryCompleted: { category: [host], type: [] } + ComputerPushCapabilityChanged: { category: [host], type: [change] } + MobileDeviceEnrolled: { category: [host], type: [change, start] } + MobileDeviceUnEnrolled: { category: [host], type: [change, end] } + MobileDeviceCheckIn: { category: [host], type: [] } + MobileDeviceInventoryCompleted: { category: [host], type: [] } + MobileDeviceCommandCompleted: { category: [host], type: [change, end] } + MobileDevicePushSent: { category: [host], type: [] } + DeviceAddedToDEP: { category: [host], type: [change] } + PushSent: { category: [host], type: [] } + SCEPChallenge: { category: [host, authentication], type: [start] } + SmartGroupComputerMembershipChange: { category: [host, iam], type: [change, group] } + SmartGroupMobileDeviceMembershipChange: { category: [host, iam], type: [change, group] } + JSSStartup: { category: [host], type: [start] } + JSSShutdown: { category: [host], type: [end] } + ComputerPolicyFinished: { category: [configuration], type: [change] } + ComputerPatchPolicyCompleted: { category: [configuration, package], type: [change] } + PatchSoftwareTitleUpdated: { category: [configuration, package], type: [change] } + RestAPIOperation: { category: [api], type: [change, admin] } + SmartGroupUserMembershipChange: { category: [iam], type: [change, group] } + source: |- + def action = ctx.event?.action; + if (action == null) { + return; + } + def entry = params.actions.get(action); + if (entry == null) { + return; + } + def cats = new ArrayList(); + def types = new ArrayList(); + if (entry.category != null) { cats.addAll(entry.category); } + if (entry.type != null) { types.addAll(entry.type); } + if (types.isEmpty()) { types.add('info'); } + ctx.event = ctx.event ?: [:]; + if (!cats.isEmpty()) { ctx.event.category = cats; } + ctx.event.type = types; + +- set: + field: event.outcome + tag: set_event_outcome_success + value: success + if: >- + ctx.jamf_pro?.events?.event?.successful == true || + ctx.jamf_pro?.events?.event?.operation_successful == true + +- set: + field: event.outcome + tag: set_event_outcome_failure + value: failure + if: >- + ctx.jamf_pro?.events?.event?.successful == false || + ctx.jamf_pro?.events?.event?.operation_successful == false + - convert: target_field: source.ip type: ip diff --git a/packages/jamf_pro/data_stream/events/sample_event.json b/packages/jamf_pro/data_stream/events/sample_event.json index dcc3ba4034d..b8d8dc9ccdd 100644 --- a/packages/jamf_pro/data_stream/events/sample_event.json +++ b/packages/jamf_pro/data_stream/events/sample_event.json @@ -1,37 +1,48 @@ { - "@timestamp": "2025-09-11T06:28:04.746Z", + "@timestamp": "2026-07-29T03:47:37.429Z", "agent": { - "ephemeral_id": "b5b7849d-c31a-41a6-ad84-82249703023b", - "id": "2c65c370-55d1-42f5-a8bb-b4146b13e120", - "name": "elastic-agent-66011", + "ephemeral_id": "14d3d101-ec1d-4152-be66-ea3a0103cf37", + "id": "da3cee98-ea12-42e4-bed8-53fa9ca483e0", + "name": "elastic-agent-22239", "type": "filebeat", - "version": "8.15.0" + "version": "8.19.2" }, "data_stream": { "dataset": "jamf_pro.events", - "namespace": "78830", + "namespace": "20970", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "2c65c370-55d1-42f5-a8bb-b4146b13e120", + "id": "da3cee98-ea12-42e4-bed8-53fa9ca483e0", "snapshot": false, - "version": "8.15.0" + "version": "8.19.2" }, "event": { "action": "ComputerAdded", "agent_id_status": "verified", + "category": [ + "host" + ], "dataset": "jamf_pro.events", - "ingested": "2025-09-11T06:28:05Z", + "ingested": "2026-07-29T03:47:38Z", "kind": "event", - "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}" + "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}", + "type": [ + "change" + ] }, "host": { "address": [ "89.160.20.156" ], + "entity": { + "lifecycle": { + "last_activity": "2024-09-04T09:57:52.001Z" + } + }, "geo": { "city_name": "Linköping", "continent_name": "Europe", @@ -46,7 +57,10 @@ }, "ip": [ "89.160.20.156" - ] + ], + "os": { + "version": "92.5786" + } }, "input": { "type": "http_endpoint" @@ -84,9 +98,6 @@ } } }, - "os": { - "version": "92.5786" - }, "related": { "user": [ "John Doe", diff --git a/packages/jamf_pro/docs/README.md b/packages/jamf_pro/docs/README.md index bd292698e78..591ba71c8d5 100644 --- a/packages/jamf_pro/docs/README.md +++ b/packages/jamf_pro/docs/README.md @@ -393,39 +393,50 @@ An example event for `events` looks as following: ```json { - "@timestamp": "2025-09-11T06:28:04.746Z", + "@timestamp": "2026-07-29T03:47:37.429Z", "agent": { - "ephemeral_id": "b5b7849d-c31a-41a6-ad84-82249703023b", - "id": "2c65c370-55d1-42f5-a8bb-b4146b13e120", - "name": "elastic-agent-66011", + "ephemeral_id": "14d3d101-ec1d-4152-be66-ea3a0103cf37", + "id": "da3cee98-ea12-42e4-bed8-53fa9ca483e0", + "name": "elastic-agent-22239", "type": "filebeat", - "version": "8.15.0" + "version": "8.19.2" }, "data_stream": { "dataset": "jamf_pro.events", - "namespace": "78830", + "namespace": "20970", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "2c65c370-55d1-42f5-a8bb-b4146b13e120", + "id": "da3cee98-ea12-42e4-bed8-53fa9ca483e0", "snapshot": false, - "version": "8.15.0" + "version": "8.19.2" }, "event": { "action": "ComputerAdded", "agent_id_status": "verified", + "category": [ + "host" + ], "dataset": "jamf_pro.events", - "ingested": "2025-09-11T06:28:05Z", + "ingested": "2026-07-29T03:47:38Z", "kind": "event", - "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}" + "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}", + "type": [ + "change" + ] }, "host": { "address": [ "89.160.20.156" ], + "entity": { + "lifecycle": { + "last_activity": "2024-09-04T09:57:52.001Z" + } + }, "geo": { "city_name": "Linköping", "continent_name": "Europe", @@ -440,7 +451,10 @@ An example event for `events` looks as following: }, "ip": [ "89.160.20.156" - ] + ], + "os": { + "version": "92.5786" + } }, "input": { "type": "http_endpoint" @@ -478,9 +492,6 @@ An example event for `events` looks as following: } } }, - "os": { - "version": "92.5786" - }, "related": { "user": [ "John Doe", diff --git a/packages/jamf_pro/manifest.yml b/packages/jamf_pro/manifest.yml index 4acce7c6689..39b657db83c 100644 --- a/packages/jamf_pro/manifest.yml +++ b/packages/jamf_pro/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.3.2 name: jamf_pro title: "Jamf Pro" -version: "1.3.0" +version: "1.3.1" source: license: "Elastic-2.0" description: "Collect logs and inventory data from Jamf Pro with Elastic Agent" diff --git a/packages/sublime_security/changelog.yml b/packages/sublime_security/changelog.yml index ccebb8350e4..81784e61d0b 100644 --- a/packages/sublime_security/changelog.yml +++ b/packages/sublime_security/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.12.2" + changes: + - description: Add ECS event categorization fields to the audit data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/20276 - version: "1.12.1" changes: - description: Use the ECS definition for email.attachments. diff --git a/packages/sublime_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/sublime_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index 413b0446385..d2114dad4e5 100644 --- a/packages/sublime_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/sublime_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -7,6 +7,9 @@ }, "event": { "action": "search", + "category": [ + "email" + ], "id": "26704b44-d1b0-4362-8221-579e604f40cb", "kind": "event", "original": "{\"id\":\"26704b44-d1b0-4362-8221-579e604f40cb\",\"type\":\"message_group.search\",\"created_at\":\"2024-07-30T05:33:47.725649Z\",\"data\":{\"request\":{\"id\":\"ca817b01-cfaa-40ea-ab80-30b6a8e6ef08\",\"path\":\"/v1/messages/groups/search\",\"method\":\"GET\",\"query\":{},\"body\":\"\",\"api_key_name\":\"demo mode key\",\"authentication_method\":\"api_key\",\"ip\":\"81.2.69.142\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}},\"created_by\":{\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"active\":true,\"first_name\":\"Bob\",\"last_name\":\"User\",\"email_address\":\"bob@example.com\",\"phone_number\":null,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\",\"role\":\"admin\",\"is_enrolled\":true,\"google_oauth_user_id\":\"\",\"microsoft_oauth_user_id\":\"\"}}", @@ -109,4 +112,4 @@ } } ] -} \ No newline at end of file +} diff --git a/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index b9d3bd9fea3..f006b4ad421 100644 --- a/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -52,11 +52,6 @@ processors: field: event.kind tag: set_event_kind_to_event value: event - - append: - field: event.type - tag: append_info_into_event_type - value: info - allow_duplicates: false - set: field: observer.vendor tag: set_observer_vendor @@ -372,6 +367,105 @@ processors: patterns: - '.*.%{WORD:event.action}' ignore_missing: true + - script: + lang: painless + tag: painless_ecs_categorization + description: Map the Sublime audit `type` to ECS event.category/event.type. + if: ctx.sublime_security?.audit?.type != null + params: + email_resources: + - message + - message_group + - email_bomb + iam_resources: + - user + - rbac + - api_key + - external_api_credential + - api_key_max_duration_set + - api_key_max_duration_cleared + - generate_password_reset + configuration_resources: + - rules + - list + - global_exclusion + - auth_settings + - org + - org_settings + - child_org + - descendant_org + - mailbox + - message_source + - abuse_mailbox + - quarantine_digest + - ip_allowlist + - trusted_sender_ips + - folder_routing + - github_app + - vendor + - logo_image + - create_child_organization + - dlp_toggled + - graymail_user_preference_changed + - auto_confirm_discovered_vendors_toggled + - synchronous_processing_monitoring_toggled + - dlp_alerts_webhook_deleted + - dlp_alerts_webhook_upserted + - inline_alerts_webhook_deleted + - inline_alerts_webhook_upserted + - inline_processing_toggled + - inline_signing_key_created + - inline_signing_key_deleted + - inline_signed_headers_retrieved + - inline_probe_injected + configuration_types: + - link_clicks.exceptions_updated + source: |- + String t = ctx.sublime_security.audit.type; + int dot = t.indexOf('.'); + String res = dot >= 0 ? t.substring(0, dot) : t; + + ArrayList cats = new ArrayList(); + ArrayList types = new ArrayList(); + + if (params.email_resources.contains(res)) { + cats.add('email'); + types.add('info'); + } else if (res == 'auth') { + cats.add('authentication'); + if (t.startsWith('auth.login')) { types.add('start'); } + else if (t == 'auth.logout') { types.add('end'); } + else { types.add('info'); } + } else if (params.iam_resources.contains(res)) { + cats.add('iam'); + if (res == 'user') { types.add('user'); } + if (res == 'rbac') { types.add('group'); } + if (t.contains('create') || t.contains('connect') || t.contains('upload')) { types.add('creation'); } + else if (t.contains('delete')) { types.add('deletion'); } + else { types.add('change'); } + } else if (params.configuration_resources.contains(res) || params.configuration_types.contains(t)) { + cats.add('configuration'); + if (t.contains('create') || t.contains('connect') || t.contains('upload')) { types.add('creation'); } + else if (t.contains('delete')) { types.add('deletion'); } + else if (t == 'inline_signed_headers_retrieved') { types.add('info'); } + else { types.add('change'); } + } + + if (!cats.isEmpty()) { + ctx.event = ctx.event ?: [:]; + ctx.event.category = cats; + ctx.event.type = types; + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: event.type + tag: append_info_into_event_type + value: info + allow_duplicates: false + if: ctx.event?.type == null - remove: field: - sublime_security.audit.created_at diff --git a/packages/sublime_security/data_stream/audit/sample_event.json b/packages/sublime_security/data_stream/audit/sample_event.json index ff09bdda474..b0bd19d1095 100644 --- a/packages/sublime_security/data_stream/audit/sample_event.json +++ b/packages/sublime_security/data_stream/audit/sample_event.json @@ -1,65 +1,48 @@ { - "@timestamp": "2024-07-30T05:33:47.725Z", + "@timestamp": "2024-08-12T06:04:03.714Z", "agent": { - "ephemeral_id": "432eaa29-8cc1-4524-8b66-ac16ba18781b", - "id": "6840d1b4-c8b0-4520-a1fc-669e9bfee96d", - "name": "elastic-agent-27648", + "ephemeral_id": "8e6eda80-4486-4b87-9073-d66d3c84a625", + "id": "a0c4e994-ec73-49cb-83eb-6ecb9baf45f7", + "name": "elastic-agent-91904", "type": "filebeat", "version": "8.18.0" }, - "aws": { - "s3": { - "bucket": { - "arn": "arn:aws:s3:::elastic-package-sublime-audit-bucket-83544", - "name": "elastic-package-sublime-audit-bucket-83544" - }, - "object": { - "key": "test-audit.log" - } - } - }, - "cloud": { - "region": "us-east-1" - }, "data_stream": { "dataset": "sublime_security.audit", - "namespace": "58929", + "namespace": "40350", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "6840d1b4-c8b0-4520-a1fc-669e9bfee96d", + "id": "a0c4e994-ec73-49cb-83eb-6ecb9baf45f7", "snapshot": false, "version": "8.18.0" }, "event": { "action": "search", "agent_id_status": "verified", + "category": [ + "email" + ], "dataset": "sublime_security.audit", - "id": "26704b44-d1b0-4362-8221-579e604f40cb", - "ingested": "2025-10-24T12:38:49Z", + "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", + "ingested": "2026-07-29T03:43:39Z", "kind": "event", - "original": "{\"id\":\"26704b44-d1b0-4362-8221-579e604f40cb\",\"type\":\"message_group.search\",\"created_at\":\"2024-07-30T05:33:47.725649Z\",\"data\":{\"request\":{\"id\":\"ca817b01-cfaa-40ea-ab80-30b6a8e6ef08\",\"path\":\"/v1/messages/groups/search\",\"method\":\"GET\",\"query\":{},\"body\":\"\",\"api_key_name\":\"demo mode key\",\"authentication_method\":\"api_key\",\"ip\":\"81.2.69.142\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}},\"created_by\":{\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"active\":true,\"first_name\":\"Bob\",\"last_name\":\"User\",\"email_address\":\"bob@example.com\",\"phone_number\":null,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\",\"role\":\"admin\",\"is_enrolled\":true,\"google_oauth_user_id\":\"\",\"microsoft_oauth_user_id\":\"\"}}", + "original": "{\"created_at\":\"2024-08-12T06:04:03.714126Z\",\"created_by\":{\"active\":true,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"email_address\":\"demo@example.com\",\"first_name\":\"Demo\",\"google_oauth_user_id\":\"d83rb8et4-refe-fe7t4f8efe\",\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"is_enrolled\":true,\"last_name\":\"User\",\"microsoft_oauth_user_id\":\"fhe7t4bgf8-freu-ebfur94ref\",\"phone_number\":null,\"role\":\"admin\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\"},\"data\":{\"request\":{\"api_key_name\":\"demo mode local\",\"authentication_method\":\"api_key\",\"body\":\"\",\"id\":\"6ad202de-0def-423d-a0f2-549402e1a9c9\",\"ip\":\"1.128.0.0\",\"method\":\"GET\",\"path\":\"/v0/message-groups\",\"user_agent\":\"Go-http-client/1.1\"}},\"id\":\"bd49af79-0cfb-4184-bd18-b0401d69ac61\",\"type\":\"message_group.search\"}", "type": [ "info" ] }, "http": { "request": { - "id": "ca817b01-cfaa-40ea-ab80-30b6a8e6ef08", + "id": "6ad202de-0def-423d-a0f2-549402e1a9c9", "method": "GET" } }, "input": { - "type": "aws-s3" - }, - "log": { - "file": { - "path": "https://elastic-package-sublime-audit-bucket-83544.s3.us-east-1.amazonaws.com/test-audit.log" - }, - "offset": 1 + "type": "cel" }, "observer": { "product": "Sublime Security", @@ -67,63 +50,65 @@ }, "related": { "ip": [ - "81.2.69.142" + "1.128.0.0" ], "user": [ - "bob@example.com", - "Bob", - "6e6eca05-4fea-406b-86d4-b40177e25474" + "demo@example.com", + "Demo", + "d83rb8et4-refe-fe7t4f8efe", + "6e6eca05-4fea-406b-86d4-b40177e25474", + "fhe7t4bgf8-freu-ebfur94ref" ] }, "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142" + "ip": "1.128.0.0" }, "sublime_security": { "audit": { + "created_at": "2024-08-12T06:04:03.714Z", "created_by": { "active": true, "created_at": "2024-07-12T05:13:47.879Z", - "first_name": "Bob", + "email_address": "demo@example.com", + "first_name": "Demo", + "google_oauth_user_id": "d83rb8et4-refe-fe7t4f8efe", + "id": "6e6eca05-4fea-406b-86d4-b40177e25474", "is_enrolled": true, "last_name": "User", + "microsoft_oauth_user_id": "fhe7t4bgf8-freu-ebfur94ref", + "role": "admin", "updated_at": "2024-07-12T05:13:47.879Z" }, "data": { "request": { - "api_key_name": "demo mode key", - "authentication_method": "api_key" + "api_key_name": "demo mode local", + "authentication_method": "api_key", + "id": "6ad202de-0def-423d-a0f2-549402e1a9c9", + "ip": "1.128.0.0", + "method": "GET", + "path": "/v0/message-groups", + "user_agent": "Go-http-client/1.1" } }, + "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", "type": "message_group.search" } }, "tags": [ - "collect_sqs_logs", "preserve_original_event", + "preserve_duplicate_custom_fields", "forwarded", "sublime_security-audit" ], "url": { - "path": "/v1/messages/groups/search" + "path": "/v0/message-groups" }, "user": { "domain": "example.com", - "email": "bob@example.com", - "full_name": "Bob User", + "email": "demo@example.com", + "full_name": "Demo User", "id": "6e6eca05-4fea-406b-86d4-b40177e25474", - "name": "bob", + "name": "demo", "roles": [ "admin" ] @@ -132,13 +117,8 @@ "device": { "name": "Other" }, - "name": "Chrome", - "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", - "os": { - "full": "Windows 10", - "name": "Windows", - "version": "10" - }, - "version": "126.0.0.0" + "name": "Go-http-client", + "original": "Go-http-client/1.1", + "version": "1.1" } } diff --git a/packages/sublime_security/docs/README.md b/packages/sublime_security/docs/README.md index 7ba811e43af..61463ef8f24 100644 --- a/packages/sublime_security/docs/README.md +++ b/packages/sublime_security/docs/README.md @@ -85,67 +85,50 @@ An example event for `audit` looks as following: ```json { - "@timestamp": "2024-07-30T05:33:47.725Z", + "@timestamp": "2024-08-12T06:04:03.714Z", "agent": { - "ephemeral_id": "432eaa29-8cc1-4524-8b66-ac16ba18781b", - "id": "6840d1b4-c8b0-4520-a1fc-669e9bfee96d", - "name": "elastic-agent-27648", + "ephemeral_id": "8e6eda80-4486-4b87-9073-d66d3c84a625", + "id": "a0c4e994-ec73-49cb-83eb-6ecb9baf45f7", + "name": "elastic-agent-91904", "type": "filebeat", "version": "8.18.0" }, - "aws": { - "s3": { - "bucket": { - "arn": "arn:aws:s3:::elastic-package-sublime-audit-bucket-83544", - "name": "elastic-package-sublime-audit-bucket-83544" - }, - "object": { - "key": "test-audit.log" - } - } - }, - "cloud": { - "region": "us-east-1" - }, "data_stream": { "dataset": "sublime_security.audit", - "namespace": "58929", + "namespace": "40350", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "6840d1b4-c8b0-4520-a1fc-669e9bfee96d", + "id": "a0c4e994-ec73-49cb-83eb-6ecb9baf45f7", "snapshot": false, "version": "8.18.0" }, "event": { "action": "search", "agent_id_status": "verified", + "category": [ + "email" + ], "dataset": "sublime_security.audit", - "id": "26704b44-d1b0-4362-8221-579e604f40cb", - "ingested": "2025-10-24T12:38:49Z", + "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", + "ingested": "2026-07-29T03:43:39Z", "kind": "event", - "original": "{\"id\":\"26704b44-d1b0-4362-8221-579e604f40cb\",\"type\":\"message_group.search\",\"created_at\":\"2024-07-30T05:33:47.725649Z\",\"data\":{\"request\":{\"id\":\"ca817b01-cfaa-40ea-ab80-30b6a8e6ef08\",\"path\":\"/v1/messages/groups/search\",\"method\":\"GET\",\"query\":{},\"body\":\"\",\"api_key_name\":\"demo mode key\",\"authentication_method\":\"api_key\",\"ip\":\"81.2.69.142\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}},\"created_by\":{\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"active\":true,\"first_name\":\"Bob\",\"last_name\":\"User\",\"email_address\":\"bob@example.com\",\"phone_number\":null,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\",\"role\":\"admin\",\"is_enrolled\":true,\"google_oauth_user_id\":\"\",\"microsoft_oauth_user_id\":\"\"}}", + "original": "{\"created_at\":\"2024-08-12T06:04:03.714126Z\",\"created_by\":{\"active\":true,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"email_address\":\"demo@example.com\",\"first_name\":\"Demo\",\"google_oauth_user_id\":\"d83rb8et4-refe-fe7t4f8efe\",\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"is_enrolled\":true,\"last_name\":\"User\",\"microsoft_oauth_user_id\":\"fhe7t4bgf8-freu-ebfur94ref\",\"phone_number\":null,\"role\":\"admin\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\"},\"data\":{\"request\":{\"api_key_name\":\"demo mode local\",\"authentication_method\":\"api_key\",\"body\":\"\",\"id\":\"6ad202de-0def-423d-a0f2-549402e1a9c9\",\"ip\":\"1.128.0.0\",\"method\":\"GET\",\"path\":\"/v0/message-groups\",\"user_agent\":\"Go-http-client/1.1\"}},\"id\":\"bd49af79-0cfb-4184-bd18-b0401d69ac61\",\"type\":\"message_group.search\"}", "type": [ "info" ] }, "http": { "request": { - "id": "ca817b01-cfaa-40ea-ab80-30b6a8e6ef08", + "id": "6ad202de-0def-423d-a0f2-549402e1a9c9", "method": "GET" } }, "input": { - "type": "aws-s3" - }, - "log": { - "file": { - "path": "https://elastic-package-sublime-audit-bucket-83544.s3.us-east-1.amazonaws.com/test-audit.log" - }, - "offset": 1 + "type": "cel" }, "observer": { "product": "Sublime Security", @@ -153,63 +136,65 @@ An example event for `audit` looks as following: }, "related": { "ip": [ - "81.2.69.142" + "1.128.0.0" ], "user": [ - "bob@example.com", - "Bob", - "6e6eca05-4fea-406b-86d4-b40177e25474" + "demo@example.com", + "Demo", + "d83rb8et4-refe-fe7t4f8efe", + "6e6eca05-4fea-406b-86d4-b40177e25474", + "fhe7t4bgf8-freu-ebfur94ref" ] }, "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142" + "ip": "1.128.0.0" }, "sublime_security": { "audit": { + "created_at": "2024-08-12T06:04:03.714Z", "created_by": { "active": true, "created_at": "2024-07-12T05:13:47.879Z", - "first_name": "Bob", + "email_address": "demo@example.com", + "first_name": "Demo", + "google_oauth_user_id": "d83rb8et4-refe-fe7t4f8efe", + "id": "6e6eca05-4fea-406b-86d4-b40177e25474", "is_enrolled": true, "last_name": "User", + "microsoft_oauth_user_id": "fhe7t4bgf8-freu-ebfur94ref", + "role": "admin", "updated_at": "2024-07-12T05:13:47.879Z" }, "data": { "request": { - "api_key_name": "demo mode key", - "authentication_method": "api_key" + "api_key_name": "demo mode local", + "authentication_method": "api_key", + "id": "6ad202de-0def-423d-a0f2-549402e1a9c9", + "ip": "1.128.0.0", + "method": "GET", + "path": "/v0/message-groups", + "user_agent": "Go-http-client/1.1" } }, + "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", "type": "message_group.search" } }, "tags": [ - "collect_sqs_logs", "preserve_original_event", + "preserve_duplicate_custom_fields", "forwarded", "sublime_security-audit" ], "url": { - "path": "/v1/messages/groups/search" + "path": "/v0/message-groups" }, "user": { "domain": "example.com", - "email": "bob@example.com", - "full_name": "Bob User", + "email": "demo@example.com", + "full_name": "Demo User", "id": "6e6eca05-4fea-406b-86d4-b40177e25474", - "name": "bob", + "name": "demo", "roles": [ "admin" ] @@ -218,14 +203,9 @@ An example event for `audit` looks as following: "device": { "name": "Other" }, - "name": "Chrome", - "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", - "os": { - "full": "Windows 10", - "name": "Windows", - "version": "10" - }, - "version": "126.0.0.0" + "name": "Go-http-client", + "original": "Go-http-client/1.1", + "version": "1.1" } } ``` diff --git a/packages/sublime_security/manifest.yml b/packages/sublime_security/manifest.yml index 107c3f1d883..0578f84a2d0 100644 --- a/packages/sublime_security/manifest.yml +++ b/packages/sublime_security/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.3.2 name: sublime_security title: Sublime Security -version: "1.12.1" +version: "1.12.2" description: Collect logs from Sublime Security with Elastic Agent. type: integration categories: