From 434ce4cbb89da11c17de2d07219d4bf7911e7212 Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Tue, 21 Jul 2026 23:09:36 +0530 Subject: [PATCH 1/9] add event categorization for azure, jamf_pro and sublime_security packges --- packages/azure/changelog.yml | 5 + .../test-activitylogs-raw.log-expected.json | 42 ++++++- ...ime-formats-corner-cases.log-expected.json | 66 ++++++++-- .../elasticsearch/ingest_pipeline/default.yml | 45 +++++++ .../graphactivitylogs/sample_event.json | 12 +- packages/azure/docs/graphactivitylogs.md | 10 +- packages/azure/manifest.yml | 2 +- packages/jamf_pro/changelog.yml | 5 + .../test-computer-added.json-expected.json | 9 +- .../test-computer-check-in.json-expected.json | 8 +- ...ter-inventory-completed.json-expected.json | 8 +- ...-patch-policy-completed.json-expected.json | 11 +- ...omputer-policy-finished.json-expected.json | 10 +- ...push-capability-changed.json-expected.json | 9 +- ...est-device-added-to-dep.json-expected.json | 9 +- .../test-jss-shutdown.json-expected.json | 9 +- .../test-jss-startup.json-expected.json | 9 +- ...-mobile-device-check-in.json-expected.json | 8 +- ...evice-command-completed.json-expected.json | 10 +- ...-mobile-device-enrolled.json-expected.json | 9 +- ...ice-inventory-completed.json-expected.json | 8 +- ...mobile-device-push-sent.json-expected.json | 8 +- ...obile-device-unenrolled.json-expected.json | 10 +- ...-software-title-updated.json-expected.json | 10 +- .../test-push-sent.json-expected.json | 8 +- ...test-rest-api-operation.json-expected.json | 11 +- .../test-scep-challenge.json-expected.json | 10 +- ...puter-membership-change.json-expected.json | 11 +- ...evice-membership-change.json-expected.json | 11 +- ...-user-membership-change.json-expected.json | 10 +- .../elasticsearch/ingest_pipeline/default.yml | 115 ++++++++++++++++++ .../data_stream/events/sample_event.json | 40 +++--- packages/jamf_pro/docs/README.md | 40 +++--- packages/jamf_pro/manifest.yml | 2 +- packages/sublime_security/changelog.yml | 5 + .../pipeline/test-audit.log-expected.json | 5 +- .../elasticsearch/ingest_pipeline/default.yml | 98 ++++++++++++++- .../data_stream/audit/sample_event.json | 108 +++++++--------- packages/sublime_security/docs/README.md | 108 +++++++--------- packages/sublime_security/manifest.yml | 2 +- 40 files changed, 707 insertions(+), 209 deletions(-) diff --git a/packages/azure/changelog.yml b/packages/azure/changelog.yml index ad2c5b53ff4..22541088c7c 100644 --- a/packages/azure/changelog.yml +++ b/packages/azure/changelog.yml @@ -1,3 +1,8 @@ +- version: "1.37.1" + changes: + - description: Add ECS event categorization fields to the graphactivitylogs data stream. + type: bugfix + link: https://github.com/elastic/integrations/issues/1 - version: "1.37.0" changes: - description: Add azure.aadgraphactivitylogs dataset to ingest legacy Azure AD Graph (graph.windows.net) AzureADGraphActivityLogs diagnostic events. diff --git a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json index d8b1508be2e..0e6be070cb6 100644 --- a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json +++ b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json @@ -70,11 +70,16 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 462680000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"durationMs\":462680,\"location\":\"West Europe\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e12-268a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe56789-a848-4c93-9d2c-5675972aejk9\",\"durationMs\":462680,\"identityProvider\":\"https://sts.windows.net/a140785b-418d-4344-a4ec-8e9648919gdb/\",\"ipAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"location\":\"West Europe\",\"operationId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"requestId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/organization/a140785b-418d-4344-a4ec-8e9648919gdb?$select=Id,DisplayName,CreatedDateTime,ReplicationScope,Country,CountryLetterCode,DataBoundary\",\"responseSizeBytes\":364,\"responseStatusCode\":200,\"roles\":\"Organization.Read.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5066-92g3-4b3dfbav50f0\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"a140785b-418d-4344-a4ec-8e9648919gdb\",\"timeGenerated\":\"2024-03-07T11:47:00.6442361Z\",\"tokenIssuedAt\":\"2024-03-07T11:42:00Z\",\"userAgent\":\"python-requests/2.27.1\",\"userId\":null,\"wids\":\"1997b4d3-0g8d-90cb-bhj8-d89n3121e90\"},\"resourceId\":\"/TENANTS/A140785B-418D-4344-A4EC-8E9648919GDB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"a140785b-418d-4344-a4ec-8e9648919gdb\",\"time\":\"2024-03-07T11:47:00.6442361Z\"}", + "outcome": "success", "type": [ - "access" + "access", + "info" ] }, "http": { @@ -215,11 +220,16 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 453011000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"durationMs\":453011,\"location\":\"Germany West Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e12-268a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe56790-a848-4c83-9d2c-5675972aejk9\",\"durationMs\":453011,\"identityProvider\":\"https://sts.windows.net/aa30985b-427d-4434-b4dc-8f9040719adb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"Germany West Central\",\"operationId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"requestId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/me/photos/96x96/$value\",\"responseSizeBytes\":294,\"responseStatusCode\":404,\"roles\":null,\"scopes\":\"email openid Organization.Read.All Policy.ReadWrite.ApplicationConfiguration profile User.Read\",\"servicePrincipalId\":null,\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"aa30985b-427d-4434-b4dc-8f9040719adb\",\"timeGenerated\":\"2024-03-07T10:35:31.9597832Z\",\"tokenIssuedAt\":\"2024-03-07T10:30:30Z\",\"userAgent\":\"\",\"userId\":\"b37ec517-0a34-4266-b627-f7bb0d679d70\",\"wids\":\"1997b4d3-0g8d-90cb-bhj5-d80n3122e98 1997b4d3-0f8d-76cb-bhj5-d80n3122e98\"},\"resourceId\":\"/TENANTS/AA30985B-427D-4434-B4DC-8F9040719ADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"404\",\"tenantId\":\"aa30985b-427d-4434-b4dc-8f9040719adb\",\"time\":\"2024-03-07T10:35:31.9597832Z\"}", + "outcome": "failure", "type": [ - "access" + "access", + "info" ] }, "http": { @@ -357,11 +367,16 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 16688471000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.144\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"durationMs\":16688471,\"location\":\"UK South\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"beta\",\"properties\":{\"apiVersion\":\"beta\",\"appId\":\"a5a68e12-268a-3c91-a5f2-b9254e67hb28\",\"atContent\":\"\",\"clientAuthMethod\":\"0\",\"clientRequestId\":\"2fe56789-a848-4c93-9s2c-5675972aghk9\",\"durationMs\":16688471,\"identityProvider\":null,\"ipAddress\":\"81.2.69.144\",\"location\":\"UK South\",\"operationId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"requestId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/beta//users/7ef3c2ad-d52l-4a89-8cf9-c30178181027/photos/48x48/$value\",\"responseSizeBytes\":0,\"responseStatusCode\":404,\"roles\":null,\"scopes\":\"AdministrativeUnit.ReadWrite.All AuditLog.Read.All Directory.AccessAsUser.All Directory.Write.Restricted email openid Organization.Read.All Policy.ReadWrite.Authorization profile User.EnableDisableAccount.All User.ReadWrite.All\",\"servicePrincipalId\":null,\"signInActivityId\":\"signin_ActivityId\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"timeGenerated\":\"2024-03-07T16:42:22.84914Z\",\"tokenIssuedAt\":\"2024-03-07T16:37:20Z\",\"userAgent\":\"\",\"userId\":\"285e0849-a706-4a9a-9eb1-f4e21cc78793\",\"wids\":\"1997b4d3-0g8d-90cb-bhj5-d80n3122e98 1997b4d3-0g8d-90cb-bhj5-d80n3122e99 1997b4d3-0g8d-90cb-bhj5-d80n3122e80 1997b4d3-0g8d-90cb-bhj5-d80n3122e83\"},\"resourceId\":\"/TENANTS/AB47545B-420E-46FG-C4DC-8F7697K1AADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"404\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"time\":\"2024-03-07T16:42:22.8491400Z\"}", + "outcome": "failure", "type": [ - "access" + "access", + "info" ] }, "http": { @@ -525,11 +540,16 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 846544000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"durationMs\":846544,\"location\":\"UK South\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"beta\",\"properties\":{\"apiVersion\":\"beta\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"0\",\"clientRequestId\":\"2fe56789-a848-4c93-9d2d-5675972ardk9\",\"durationMs\":846544,\"identityProvider\":null,\"ipAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"location\":\"UK South\",\"operationId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"requestId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/beta/devices?$select=displayName,id,deviceId\\\\u0026$search=%22displayName:a%22\\\\u0026$top=30\",\"responseSizeBytes\":0,\"responseStatusCode\":200,\"roles\":null,\"scopes\":\"AccessReview.ReadWrite.All AuditLog.Read.All ChangeManagement.Read.All ConsentRequest.Create ConsentRequest.Read ConsentRequest.ReadApprove.All ConsentRequest.ReadWrite.All CustomSecAttributeAuditLogs.Read.All Directory.AccessAsUser.All Directory.Read.All Directory.ReadWrite.All Directory.Write.Restricted DirectoryRecommendations.Read.All DirectoryRecommendations.ReadWrite.All email EntitlementManagement.Read.All Group.ReadWrite.All IdentityProvider.ReadWrite.All IdentityRiskEvent.ReadWrite.All IdentityRiskyServicePrincipal.ReadWrite.All IdentityRiskyUser.ReadWrite.All IdentityUserFlow.Read.All LifecycleWorkflows.ReadWrite.All openid Policy.Read.All Policy.Read.IdentityProtection Policy.ReadWrite.AuthenticationFlows Policy.ReadWrite.AuthenticationMethod Policy.ReadWrite.ConditionalAccess Policy.ReadWrite.ExternalIdentities Policy.ReadWrite.IdentityProtection Policy.ReadWrite.MobilityManagement profile Reports.Read.All RoleManagement.ReadWrite.Directory RoleManagement.ReadWrite.Exchange SecurityEvents.ReadWrite.All TrustFrameworkKeySet.Read.All User.Export.All User.ReadWrite.All UserAuthenticationMethod.ReadWrite.All\",\"servicePrincipalId\":null,\"signInActivityId\":\"signin_Activity-Id\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"timeGenerated\":\"2024-03-07T16:42:12.0485843Z\",\"tokenIssuedAt\":\"2024-03-07T16:36:51Z\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0\",\"userId\":\"285e0849-a706-4a9a-9eb1-f4e21cc78793\",\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3122e67 a207b4d3-0g8d-90cb-bhj5-d80n3122e69 a207b4d3-0g8d-90cb-bhj5-d80n3122e89\"},\"resourceId\":\"/TENANTS/AB47545B-420E-46FG-C4DC-8F7697K1AADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"time\":\"2024-03-07T16:42:12.0485843Z\"}", + "outcome": "success", "type": [ - "access" + "access", + "info" ] }, "http": { @@ -678,11 +698,16 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 1100725000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", + "outcome": "success", "type": [ - "access" + "access", + "info" ] }, "http": { @@ -828,11 +853,16 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 1100725000000, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"C_DeviceId\": \"abc123\",\"c_Sid\":\"xyz000\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", + "outcome": "success", "type": [ - "access" + "access", + "info" ] }, "http": { diff --git a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json index c87a3ad2030..693aa3144fe 100644 --- a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json +++ b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json @@ -17,10 +17,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"01/09/2007 09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -44,10 +48,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"1/9/2007 09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -71,10 +79,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"01/09/2007 09:41:00 AM\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -98,10 +110,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"1/9/2007 9:41:00 AM\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -125,10 +141,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"1/9/2007 10:41:00 AM +01:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -152,10 +172,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -179,10 +203,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.22Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -206,10 +234,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.6816663Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -233,10 +265,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.535404056Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -260,10 +296,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.992099+00:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ @@ -287,10 +327,14 @@ "version": "8.11.0" }, "event": { + "category": [ + "api" + ], "kind": "event", "original": "{\"time\": \"2007-01-09T11:41:00+02:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access" + "access", + "info" ] }, "tags": [ diff --git a/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml index ce7b0278249..e6f0a9ab279 100644 --- a/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml @@ -422,6 +422,51 @@ processors: - append: field: error.message value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: event.category + value: api + tag: append_api_into_event_category + allow_duplicates: false + - append: + field: event.type + value: info + tag: append_info_into_event_type + allow_duplicates: false + if: ctx.http?.request?.method == null || ctx.http.request.method == 'GET' || ctx.http.request.method == 'HEAD' + - append: + field: event.type + value: creation + tag: append_creation_into_event_type + allow_duplicates: false + if: ctx.http?.request?.method == 'POST' + - append: + field: event.type + value: change + tag: append_change_into_event_type + allow_duplicates: false + if: ctx.http?.request?.method == 'PATCH' || ctx.http?.request?.method == 'PUT' + - append: + field: event.type + value: deletion + tag: append_deletion_into_event_type + allow_duplicates: false + if: ctx.http?.request?.method == 'DELETE' + - append: + field: event.type + value: denied + tag: append_denied_into_event_type + allow_duplicates: false + if: ctx.http?.response?.status_code == 401 || ctx.http?.response?.status_code == 403 + - set: + field: event.outcome + value: success + tag: set-event_outcome-success + if: ctx.http?.response?.status_code != null && ctx.http.response.status_code >= 200 && ctx.http.response.status_code < 300 + - set: + field: event.outcome + value: failure + tag: set-event_outcome-failure + if: ctx.http?.response?.status_code != null && ctx.http.response.status_code >= 400 - pipeline: name: '{{ IngestPipeline "azure-shared-pipeline" }}' tag: pipeline-azure-shared-pipeline diff --git a/packages/azure/data_stream/graphactivitylogs/sample_event.json b/packages/azure/data_stream/graphactivitylogs/sample_event.json index 2558fec3160..220a5bc4d97 100644 --- a/packages/azure/data_stream/graphactivitylogs/sample_event.json +++ b/packages/azure/data_stream/graphactivitylogs/sample_event.json @@ -82,8 +82,14 @@ "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", "type": [ - "access" - ] + "access", + "info" + ], + "category": [ + "api" + ], + "outcome": "success", + "id": "f7839da0-e7d1-4e4f-985a-64937fbge347" }, "http": { "request": { @@ -128,4 +134,4 @@ "path": "/v1.0/directoryRoles", "scheme": "https" } -} \ No newline at end of file +} diff --git a/packages/azure/docs/graphactivitylogs.md b/packages/azure/docs/graphactivitylogs.md index 9344f266688..7655dcb42c1 100644 --- a/packages/azure/docs/graphactivitylogs.md +++ b/packages/azure/docs/graphactivitylogs.md @@ -166,8 +166,14 @@ An example event for `graphactivitylogs` looks as following: "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", "type": [ - "access" - ] + "access", + "info" + ], + "category": [ + "api" + ], + "outcome": "success", + "id": "f7839da0-e7d1-4e4f-985a-64937fbge347" }, "http": { "request": { diff --git a/packages/azure/manifest.yml b/packages/azure/manifest.yml index 4d36c4ee9d2..ef84192596d 100644 --- a/packages/azure/manifest.yml +++ b/packages/azure/manifest.yml @@ -1,6 +1,6 @@ name: azure title: Azure Logs -version: "1.37.0" +version: "1.37.1" description: This Elastic integration collects logs from Azure type: integration icons: diff --git a/packages/jamf_pro/changelog.yml b/packages/jamf_pro/changelog.yml index b308252030c..9faf486ca6f 100644 --- a/packages/jamf_pro/changelog.yml +++ b/packages/jamf_pro/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.3.1" + changes: + - description: Add ECS event categorization fields to the events data stream. + type: bugfix + link: https://github.com/elastic/integrations/issues/1 - version: "1.3.0" changes: - description: Enable Agentless deployment. diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json index fd627f116ba..945b93dbb75 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "ComputerAdded", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-check-in.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-check-in.json-expected.json index 63554a42b95..05a148dff08 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-check-in.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-check-in.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "ComputerCheckIn", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-inventory-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-inventory-completed.json-expected.json index 73b15cb6e10..b5555c254ee 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-inventory-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-inventory-completed.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "ComputerInventoryCompleted", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json index bdd10571f03..4b76f2d0698 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json @@ -6,7 +6,16 @@ }, "event": { "action": "ComputerPatchPolicyCompleted", - "kind": "event" + "category": [ + "configuration", + "package" + ], + "kind": "event", + "outcome": "success", + "type": [ + "change", + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json index 1e420e32daa..b62cde6682e 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "ComputerPolicyFinished", - "kind": "event" + "category": [ + "configuration" + ], + "kind": "event", + "outcome": "success", + "type": [ + "change", + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json index 12cfd832643..27c751727cd 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "ComputerPushCapabilityChanged", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json index 494b40bcd03..42955661e9c 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "DeviceAddedToDEP", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json index b8a3aba7d05..313c4fcddd6 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "JSSShutdown", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "end", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json index 307dd93208b..dd0ecb8e57d 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "JSSStartup", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "start", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-check-in.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-check-in.json-expected.json index 0d6f65d2b17..42ae340bd66 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-check-in.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-check-in.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "MobileDeviceCheckIn", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json index 55b2aeb8645..66b1f044385 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "MobileDeviceCommandCompleted", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "end", + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json index 62b04117ce8..0ee30fd1278 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json @@ -6,7 +6,14 @@ }, "event": { "action": "MobileDeviceEnrolled", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-inventory-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-inventory-completed.json-expected.json index 9be8a3c922f..56d5acf5fa8 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-inventory-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-inventory-completed.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "MobileDeviceInventoryCompleted", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-push-sent.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-push-sent.json-expected.json index ffe21c5521b..d2e911e9bd2 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-push-sent.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-push-sent.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "MobileDevicePushSent", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json index e4c29088ec2..858bbbed67e 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "MobileDeviceUnEnrolled", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "change", + "end", + "info" + ] }, "host": { "address": [ diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json index 7f7690502fa..8a98833003c 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "PatchSoftwareTitleUpdated", - "kind": "event" + "category": [ + "configuration", + "package" + ], + "kind": "event", + "type": [ + "change", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-push-sent.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-push-sent.json-expected.json index bed623ad05b..134eb6d7c22 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-push-sent.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-push-sent.json-expected.json @@ -6,7 +6,13 @@ }, "event": { "action": "PushSent", - "kind": "event" + "category": [ + "host" + ], + "kind": "event", + "type": [ + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json index a9f9dbd01b5..06db2d43cdc 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json @@ -6,7 +6,16 @@ }, "event": { "action": "RestAPIOperation", - "kind": "event" + "category": [ + "api" + ], + "kind": "event", + "outcome": "success", + "type": [ + "change", + "admin", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json index c6b198c2a7d..2d95115add5 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "SCEPChallenge", - "kind": "event" + "category": [ + "host", + "authentication" + ], + "kind": "event", + "type": [ + "start", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json index 6aaaa3b4c10..f278c5a6b3a 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json @@ -6,7 +6,16 @@ }, "event": { "action": "SmartGroupComputerMembershipChange", - "kind": "event" + "category": [ + "host", + "iam" + ], + "kind": "event", + "type": [ + "change", + "group", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json index a3553fc08fa..7e54925ed84 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json @@ -6,7 +6,16 @@ }, "event": { "action": "SmartGroupMobileDeviceMembershipChange", - "kind": "event" + "category": [ + "host", + "iam" + ], + "kind": "event", + "type": [ + "change", + "group", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json index d6e83619d3a..ad3dca5f314 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json @@ -6,7 +6,15 @@ }, "event": { "action": "SmartGroupUserMembershipChange", - "kind": "event" + "category": [ + "iam" + ], + "kind": "event", + "type": [ + "change", + "group", + "info" + ] }, "host": { "entity": { diff --git a/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml index dd51553df6a..e9b3b73f4df 100644 --- a/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -182,6 +182,121 @@ processors: copy_from: jamf_pro.events.webhook.webhook_event ignore_empty_value: true +# event.category — keyed on event.action +- append: + field: event.category + tag: append_host_into_event_category + value: host + if: >- + ctx.event?.action != null && + ['ComputerAdded', 'ComputerCheckIn', 'ComputerInventoryCompleted', + 'ComputerPushCapabilityChanged', 'MobileDeviceEnrolled', + 'MobileDeviceUnEnrolled', 'MobileDeviceCheckIn', + 'MobileDeviceInventoryCompleted', 'MobileDeviceCommandCompleted', + 'MobileDevicePushSent', 'DeviceAddedToDEP', 'PushSent', 'SCEPChallenge', + 'SmartGroupComputerMembershipChange', + 'SmartGroupMobileDeviceMembershipChange', 'JSSStartup', + 'JSSShutdown'].contains(ctx.event.action) +- append: + field: event.category + tag: append_configuration_into_event_category + value: configuration + if: >- + ctx.event?.action != null && + ['ComputerPolicyFinished', 'ComputerPatchPolicyCompleted', + 'PatchSoftwareTitleUpdated'].contains(ctx.event.action) +- append: + field: event.category + tag: append_package_into_event_category + value: package + if: >- + ctx.event?.action != null && + ['ComputerPatchPolicyCompleted', 'PatchSoftwareTitleUpdated'].contains(ctx.event.action) +- append: + field: event.category + tag: append_api_into_event_category + value: api + if: ctx.event?.action == 'RestAPIOperation' +- append: + field: event.category + tag: append_iam_into_event_category + value: iam + if: >- + ctx.event?.action != null && + ['SmartGroupComputerMembershipChange', + 'SmartGroupMobileDeviceMembershipChange', + 'SmartGroupUserMembershipChange'].contains(ctx.event.action) +- append: + field: event.category + tag: append_authentication_into_event_category + value: authentication + if: ctx.event?.action == 'SCEPChallenge' + +# event.type — keyed on event.action +- append: + field: event.type + tag: append_change_into_event_type + value: change + if: >- + ctx.event?.action != null && + ['ComputerAdded', 'ComputerPushCapabilityChanged', + 'ComputerPolicyFinished', 'ComputerPatchPolicyCompleted', + 'MobileDeviceEnrolled', 'MobileDeviceUnEnrolled', + 'MobileDeviceCommandCompleted', 'DeviceAddedToDEP', + 'PatchSoftwareTitleUpdated', 'RestAPIOperation', + 'SmartGroupComputerMembershipChange', + 'SmartGroupMobileDeviceMembershipChange', + 'SmartGroupUserMembershipChange'].contains(ctx.event.action) +- append: + field: event.type + tag: append_end_into_event_type + value: end + if: >- + ctx.event?.action != null && + ['MobileDeviceUnEnrolled', 'MobileDeviceCommandCompleted', + 'JSSShutdown'].contains(ctx.event.action) +- append: + field: event.type + tag: append_start_into_event_type + value: start + if: >- + ctx.event?.action != null && + ['SCEPChallenge', 'JSSStartup'].contains(ctx.event.action) +- append: + field: event.type + tag: append_admin_into_event_type + value: admin + if: ctx.event?.action == 'RestAPIOperation' +- append: + field: event.type + tag: append_group_into_event_type + value: group + if: >- + ctx.event?.action != null && + ['SmartGroupComputerMembershipChange', + 'SmartGroupMobileDeviceMembershipChange', + 'SmartGroupUserMembershipChange'].contains(ctx.event.action) +- append: + field: event.type + tag: append_info_default_into_event_type + value: info + +- set: + field: event.outcome + tag: set_event_outcome_success + value: success + if: >- + ctx.jamf_pro?.events?.event?.successful == true || + ctx.jamf_pro?.events?.event?.operation_successful == true + +- set: + field: event.outcome + tag: set_event_outcome_failure + value: failure + if: >- + ctx.jamf_pro?.events?.event?.successful == false || + ctx.jamf_pro?.events?.event?.operation_successful == false + - convert: target_field: source.ip type: ip diff --git a/packages/jamf_pro/data_stream/events/sample_event.json b/packages/jamf_pro/data_stream/events/sample_event.json index dcc3ba4034d..72d6452e02a 100644 --- a/packages/jamf_pro/data_stream/events/sample_event.json +++ b/packages/jamf_pro/data_stream/events/sample_event.json @@ -1,37 +1,49 @@ { - "@timestamp": "2025-09-11T06:28:04.746Z", + "@timestamp": "2026-07-21T17:37:04.022Z", "agent": { - "ephemeral_id": "b5b7849d-c31a-41a6-ad84-82249703023b", - "id": "2c65c370-55d1-42f5-a8bb-b4146b13e120", - "name": "elastic-agent-66011", + "ephemeral_id": "5e4d40af-0b00-44c6-8b69-21ab15fb467e", + "id": "70a5daad-17e0-4285-8ac4-324572156b0d", + "name": "elastic-agent-61007", "type": "filebeat", - "version": "8.15.0" + "version": "8.19.2" }, "data_stream": { "dataset": "jamf_pro.events", - "namespace": "78830", + "namespace": "15745", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "2c65c370-55d1-42f5-a8bb-b4146b13e120", + "id": "70a5daad-17e0-4285-8ac4-324572156b0d", "snapshot": false, - "version": "8.15.0" + "version": "8.19.2" }, "event": { "action": "ComputerAdded", "agent_id_status": "verified", + "category": [ + "host" + ], "dataset": "jamf_pro.events", - "ingested": "2025-09-11T06:28:05Z", + "ingested": "2026-07-21T17:37:05Z", "kind": "event", - "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}" + "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}", + "type": [ + "change", + "info" + ] }, "host": { "address": [ "89.160.20.156" ], + "entity": { + "lifecycle": { + "last_activity": "2024-09-04T09:57:52.001Z" + } + }, "geo": { "city_name": "Linköping", "continent_name": "Europe", @@ -46,7 +58,10 @@ }, "ip": [ "89.160.20.156" - ] + ], + "os": { + "version": "92.5786" + } }, "input": { "type": "http_endpoint" @@ -84,9 +99,6 @@ } } }, - "os": { - "version": "92.5786" - }, "related": { "user": [ "John Doe", diff --git a/packages/jamf_pro/docs/README.md b/packages/jamf_pro/docs/README.md index bd292698e78..4e43bdb7a17 100644 --- a/packages/jamf_pro/docs/README.md +++ b/packages/jamf_pro/docs/README.md @@ -393,39 +393,51 @@ An example event for `events` looks as following: ```json { - "@timestamp": "2025-09-11T06:28:04.746Z", + "@timestamp": "2026-07-21T17:37:04.022Z", "agent": { - "ephemeral_id": "b5b7849d-c31a-41a6-ad84-82249703023b", - "id": "2c65c370-55d1-42f5-a8bb-b4146b13e120", - "name": "elastic-agent-66011", + "ephemeral_id": "5e4d40af-0b00-44c6-8b69-21ab15fb467e", + "id": "70a5daad-17e0-4285-8ac4-324572156b0d", + "name": "elastic-agent-61007", "type": "filebeat", - "version": "8.15.0" + "version": "8.19.2" }, "data_stream": { "dataset": "jamf_pro.events", - "namespace": "78830", + "namespace": "15745", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "2c65c370-55d1-42f5-a8bb-b4146b13e120", + "id": "70a5daad-17e0-4285-8ac4-324572156b0d", "snapshot": false, - "version": "8.15.0" + "version": "8.19.2" }, "event": { "action": "ComputerAdded", "agent_id_status": "verified", + "category": [ + "host" + ], "dataset": "jamf_pro.events", - "ingested": "2025-09-11T06:28:05Z", + "ingested": "2026-07-21T17:37:05Z", "kind": "event", - "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}" + "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}", + "type": [ + "change", + "info" + ] }, "host": { "address": [ "89.160.20.156" ], + "entity": { + "lifecycle": { + "last_activity": "2024-09-04T09:57:52.001Z" + } + }, "geo": { "city_name": "Linköping", "continent_name": "Europe", @@ -440,7 +452,10 @@ An example event for `events` looks as following: }, "ip": [ "89.160.20.156" - ] + ], + "os": { + "version": "92.5786" + } }, "input": { "type": "http_endpoint" @@ -478,9 +493,6 @@ An example event for `events` looks as following: } } }, - "os": { - "version": "92.5786" - }, "related": { "user": [ "John Doe", diff --git a/packages/jamf_pro/manifest.yml b/packages/jamf_pro/manifest.yml index 4acce7c6689..39b657db83c 100644 --- a/packages/jamf_pro/manifest.yml +++ b/packages/jamf_pro/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.3.2 name: jamf_pro title: "Jamf Pro" -version: "1.3.0" +version: "1.3.1" source: license: "Elastic-2.0" description: "Collect logs and inventory data from Jamf Pro with Elastic Agent" diff --git a/packages/sublime_security/changelog.yml b/packages/sublime_security/changelog.yml index ccebb8350e4..9ec3f6ce779 100644 --- a/packages/sublime_security/changelog.yml +++ b/packages/sublime_security/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.12.2" + changes: + - description: Add ECS event categorization fields to the audit data stream. + type: bugfix + link: https://github.com/elastic/integrations/issues/1 - version: "1.12.1" changes: - description: Use the ECS definition for email.attachments. diff --git a/packages/sublime_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/sublime_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index 413b0446385..d2114dad4e5 100644 --- a/packages/sublime_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/sublime_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -7,6 +7,9 @@ }, "event": { "action": "search", + "category": [ + "email" + ], "id": "26704b44-d1b0-4362-8221-579e604f40cb", "kind": "event", "original": "{\"id\":\"26704b44-d1b0-4362-8221-579e604f40cb\",\"type\":\"message_group.search\",\"created_at\":\"2024-07-30T05:33:47.725649Z\",\"data\":{\"request\":{\"id\":\"ca817b01-cfaa-40ea-ab80-30b6a8e6ef08\",\"path\":\"/v1/messages/groups/search\",\"method\":\"GET\",\"query\":{},\"body\":\"\",\"api_key_name\":\"demo mode key\",\"authentication_method\":\"api_key\",\"ip\":\"81.2.69.142\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}},\"created_by\":{\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"active\":true,\"first_name\":\"Bob\",\"last_name\":\"User\",\"email_address\":\"bob@example.com\",\"phone_number\":null,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\",\"role\":\"admin\",\"is_enrolled\":true,\"google_oauth_user_id\":\"\",\"microsoft_oauth_user_id\":\"\"}}", @@ -109,4 +112,4 @@ } } ] -} \ No newline at end of file +} diff --git a/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index b9d3bd9fea3..2e446ec4fb5 100644 --- a/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -52,11 +52,6 @@ processors: field: event.kind tag: set_event_kind_to_event value: event - - append: - field: event.type - tag: append_info_into_event_type - value: info - allow_duplicates: false - set: field: observer.vendor tag: set_observer_vendor @@ -372,6 +367,99 @@ processors: patterns: - '.*.%{WORD:event.action}' ignore_missing: true + - script: + lang: painless + tag: painless_ecs_categorization + description: Map the Sublime audit `type` to ECS event.category/event.type. + if: ctx.sublime_security?.audit?.type != null + params: + email_resources: + - message + - message_group + - email_bomb + iam_resources: + - user + - rbac + - api_key + - external_api_credential + - api_key_max_duration_set + - api_key_max_duration_cleared + - generate_password_reset + configuration_resources: + - rules + - list + - global_exclusion + - auth_settings + - org + - org_settings + - child_org + - descendant_org + - mailbox + - message_source + - abuse_mailbox + - quarantine_digest + - ip_allowlist + - trusted_sender_ips + - folder_routing + - github_app + - vendor + - logo_image + - create_child_organization + - dlp_toggled + - graymail_user_preference_changed + - auto_confirm_discovered_vendors_toggled + - synchronous_processing_monitoring_toggled + - dlp_alerts_webhook_deleted + - dlp_alerts_webhook_upserted + - inline_alerts_webhook_deleted + - inline_alerts_webhook_upserted + - inline_processing_toggled + - inline_signing_key_created + - inline_signing_key_deleted + - inline_signed_headers_retrieved + - inline_probe_injected + configuration_types: + - link_clicks.exceptions_updated + source: |- + String t = ctx.sublime_security.audit.type; + int dot = t.indexOf('.'); + String res = dot >= 0 ? t.substring(0, dot) : t; + + ArrayList cats = new ArrayList(); + ArrayList types = new ArrayList(); + + if (params.email_resources.contains(res)) { + cats.add('email'); + types.add('info'); + } else if (res == 'auth') { + cats.add('authentication'); + if (t.startsWith('auth.login')) { types.add('start'); } + else if (t == 'auth.logout') { types.add('end'); } + else { types.add('info'); } + } else if (params.iam_resources.contains(res)) { + cats.add('iam'); + if (res == 'user') { types.add('user'); } + if (res == 'rbac') { types.add('group'); } + if (t.contains('create') || t.contains('connect') || t.contains('upload')) { types.add('creation'); } + else if (t.contains('delete')) { types.add('deletion'); } + else { types.add('change'); } + } else if (params.configuration_resources.contains(res) || params.configuration_types.contains(t)) { + cats.add('configuration'); + if (t.contains('create') || t.contains('connect') || t.contains('upload')) { types.add('creation'); } + else if (t.contains('delete')) { types.add('deletion'); } + else if (t == 'inline_signed_headers_retrieved') { types.add('info'); } + else { types.add('change'); } + } + + if (!cats.isEmpty()) { + ctx.event = ctx.event ?: [:]; + ctx.event.category = cats; + ctx.event.type = types; + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - remove: field: - sublime_security.audit.created_at diff --git a/packages/sublime_security/data_stream/audit/sample_event.json b/packages/sublime_security/data_stream/audit/sample_event.json index ff09bdda474..f0c3247f412 100644 --- a/packages/sublime_security/data_stream/audit/sample_event.json +++ b/packages/sublime_security/data_stream/audit/sample_event.json @@ -1,65 +1,48 @@ { - "@timestamp": "2024-07-30T05:33:47.725Z", + "@timestamp": "2024-08-12T06:04:03.714Z", "agent": { - "ephemeral_id": "432eaa29-8cc1-4524-8b66-ac16ba18781b", - "id": "6840d1b4-c8b0-4520-a1fc-669e9bfee96d", - "name": "elastic-agent-27648", + "ephemeral_id": "2b197f60-692d-486d-929b-af4554d5af39", + "id": "c74dc03b-0bc0-472c-81a8-dea343a0631e", + "name": "elastic-agent-43723", "type": "filebeat", "version": "8.18.0" }, - "aws": { - "s3": { - "bucket": { - "arn": "arn:aws:s3:::elastic-package-sublime-audit-bucket-83544", - "name": "elastic-package-sublime-audit-bucket-83544" - }, - "object": { - "key": "test-audit.log" - } - } - }, - "cloud": { - "region": "us-east-1" - }, "data_stream": { "dataset": "sublime_security.audit", - "namespace": "58929", + "namespace": "55804", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "6840d1b4-c8b0-4520-a1fc-669e9bfee96d", + "id": "c74dc03b-0bc0-472c-81a8-dea343a0631e", "snapshot": false, "version": "8.18.0" }, "event": { "action": "search", "agent_id_status": "verified", + "category": [ + "email" + ], "dataset": "sublime_security.audit", - "id": "26704b44-d1b0-4362-8221-579e604f40cb", - "ingested": "2025-10-24T12:38:49Z", + "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", + "ingested": "2026-07-21T17:26:37Z", "kind": "event", - "original": "{\"id\":\"26704b44-d1b0-4362-8221-579e604f40cb\",\"type\":\"message_group.search\",\"created_at\":\"2024-07-30T05:33:47.725649Z\",\"data\":{\"request\":{\"id\":\"ca817b01-cfaa-40ea-ab80-30b6a8e6ef08\",\"path\":\"/v1/messages/groups/search\",\"method\":\"GET\",\"query\":{},\"body\":\"\",\"api_key_name\":\"demo mode key\",\"authentication_method\":\"api_key\",\"ip\":\"81.2.69.142\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}},\"created_by\":{\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"active\":true,\"first_name\":\"Bob\",\"last_name\":\"User\",\"email_address\":\"bob@example.com\",\"phone_number\":null,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\",\"role\":\"admin\",\"is_enrolled\":true,\"google_oauth_user_id\":\"\",\"microsoft_oauth_user_id\":\"\"}}", + "original": "{\"created_at\":\"2024-08-12T06:04:03.714126Z\",\"created_by\":{\"active\":true,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"email_address\":\"demo@example.com\",\"first_name\":\"Demo\",\"google_oauth_user_id\":\"d83rb8et4-refe-fe7t4f8efe\",\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"is_enrolled\":true,\"last_name\":\"User\",\"microsoft_oauth_user_id\":\"fhe7t4bgf8-freu-ebfur94ref\",\"phone_number\":null,\"role\":\"admin\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\"},\"data\":{\"request\":{\"api_key_name\":\"demo mode local\",\"authentication_method\":\"api_key\",\"body\":\"\",\"id\":\"6ad202de-0def-423d-a0f2-549402e1a9c9\",\"ip\":\"1.128.0.0\",\"method\":\"GET\",\"path\":\"/v0/message-groups\",\"user_agent\":\"Go-http-client/1.1\"}},\"id\":\"bd49af79-0cfb-4184-bd18-b0401d69ac61\",\"type\":\"message_group.search\"}", "type": [ "info" ] }, "http": { "request": { - "id": "ca817b01-cfaa-40ea-ab80-30b6a8e6ef08", + "id": "6ad202de-0def-423d-a0f2-549402e1a9c9", "method": "GET" } }, "input": { - "type": "aws-s3" - }, - "log": { - "file": { - "path": "https://elastic-package-sublime-audit-bucket-83544.s3.us-east-1.amazonaws.com/test-audit.log" - }, - "offset": 1 + "type": "cel" }, "observer": { "product": "Sublime Security", @@ -67,63 +50,65 @@ }, "related": { "ip": [ - "81.2.69.142" + "1.128.0.0" ], "user": [ - "bob@example.com", - "Bob", - "6e6eca05-4fea-406b-86d4-b40177e25474" + "demo@example.com", + "Demo", + "d83rb8et4-refe-fe7t4f8efe", + "6e6eca05-4fea-406b-86d4-b40177e25474", + "fhe7t4bgf8-freu-ebfur94ref" ] }, "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142" + "ip": "1.128.0.0" }, "sublime_security": { "audit": { + "created_at": "2024-08-12T06:04:03.714Z", "created_by": { "active": true, "created_at": "2024-07-12T05:13:47.879Z", - "first_name": "Bob", + "email_address": "demo@example.com", + "first_name": "Demo", + "google_oauth_user_id": "d83rb8et4-refe-fe7t4f8efe", + "id": "6e6eca05-4fea-406b-86d4-b40177e25474", "is_enrolled": true, "last_name": "User", + "microsoft_oauth_user_id": "fhe7t4bgf8-freu-ebfur94ref", + "role": "admin", "updated_at": "2024-07-12T05:13:47.879Z" }, "data": { "request": { - "api_key_name": "demo mode key", - "authentication_method": "api_key" + "api_key_name": "demo mode local", + "authentication_method": "api_key", + "id": "6ad202de-0def-423d-a0f2-549402e1a9c9", + "ip": "1.128.0.0", + "method": "GET", + "path": "/v0/message-groups", + "user_agent": "Go-http-client/1.1" } }, + "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", "type": "message_group.search" } }, "tags": [ - "collect_sqs_logs", "preserve_original_event", + "preserve_duplicate_custom_fields", "forwarded", "sublime_security-audit" ], "url": { - "path": "/v1/messages/groups/search" + "path": "/v0/message-groups" }, "user": { "domain": "example.com", - "email": "bob@example.com", - "full_name": "Bob User", + "email": "demo@example.com", + "full_name": "Demo User", "id": "6e6eca05-4fea-406b-86d4-b40177e25474", - "name": "bob", + "name": "demo", "roles": [ "admin" ] @@ -132,13 +117,8 @@ "device": { "name": "Other" }, - "name": "Chrome", - "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", - "os": { - "full": "Windows 10", - "name": "Windows", - "version": "10" - }, - "version": "126.0.0.0" + "name": "Go-http-client", + "original": "Go-http-client/1.1", + "version": "1.1" } } diff --git a/packages/sublime_security/docs/README.md b/packages/sublime_security/docs/README.md index 7ba811e43af..426b718f81e 100644 --- a/packages/sublime_security/docs/README.md +++ b/packages/sublime_security/docs/README.md @@ -85,67 +85,50 @@ An example event for `audit` looks as following: ```json { - "@timestamp": "2024-07-30T05:33:47.725Z", + "@timestamp": "2024-08-12T06:04:03.714Z", "agent": { - "ephemeral_id": "432eaa29-8cc1-4524-8b66-ac16ba18781b", - "id": "6840d1b4-c8b0-4520-a1fc-669e9bfee96d", - "name": "elastic-agent-27648", + "ephemeral_id": "2b197f60-692d-486d-929b-af4554d5af39", + "id": "c74dc03b-0bc0-472c-81a8-dea343a0631e", + "name": "elastic-agent-43723", "type": "filebeat", "version": "8.18.0" }, - "aws": { - "s3": { - "bucket": { - "arn": "arn:aws:s3:::elastic-package-sublime-audit-bucket-83544", - "name": "elastic-package-sublime-audit-bucket-83544" - }, - "object": { - "key": "test-audit.log" - } - } - }, - "cloud": { - "region": "us-east-1" - }, "data_stream": { "dataset": "sublime_security.audit", - "namespace": "58929", + "namespace": "55804", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "6840d1b4-c8b0-4520-a1fc-669e9bfee96d", + "id": "c74dc03b-0bc0-472c-81a8-dea343a0631e", "snapshot": false, "version": "8.18.0" }, "event": { "action": "search", "agent_id_status": "verified", + "category": [ + "email" + ], "dataset": "sublime_security.audit", - "id": "26704b44-d1b0-4362-8221-579e604f40cb", - "ingested": "2025-10-24T12:38:49Z", + "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", + "ingested": "2026-07-21T17:26:37Z", "kind": "event", - "original": "{\"id\":\"26704b44-d1b0-4362-8221-579e604f40cb\",\"type\":\"message_group.search\",\"created_at\":\"2024-07-30T05:33:47.725649Z\",\"data\":{\"request\":{\"id\":\"ca817b01-cfaa-40ea-ab80-30b6a8e6ef08\",\"path\":\"/v1/messages/groups/search\",\"method\":\"GET\",\"query\":{},\"body\":\"\",\"api_key_name\":\"demo mode key\",\"authentication_method\":\"api_key\",\"ip\":\"81.2.69.142\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}},\"created_by\":{\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"active\":true,\"first_name\":\"Bob\",\"last_name\":\"User\",\"email_address\":\"bob@example.com\",\"phone_number\":null,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\",\"role\":\"admin\",\"is_enrolled\":true,\"google_oauth_user_id\":\"\",\"microsoft_oauth_user_id\":\"\"}}", + "original": "{\"created_at\":\"2024-08-12T06:04:03.714126Z\",\"created_by\":{\"active\":true,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"email_address\":\"demo@example.com\",\"first_name\":\"Demo\",\"google_oauth_user_id\":\"d83rb8et4-refe-fe7t4f8efe\",\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"is_enrolled\":true,\"last_name\":\"User\",\"microsoft_oauth_user_id\":\"fhe7t4bgf8-freu-ebfur94ref\",\"phone_number\":null,\"role\":\"admin\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\"},\"data\":{\"request\":{\"api_key_name\":\"demo mode local\",\"authentication_method\":\"api_key\",\"body\":\"\",\"id\":\"6ad202de-0def-423d-a0f2-549402e1a9c9\",\"ip\":\"1.128.0.0\",\"method\":\"GET\",\"path\":\"/v0/message-groups\",\"user_agent\":\"Go-http-client/1.1\"}},\"id\":\"bd49af79-0cfb-4184-bd18-b0401d69ac61\",\"type\":\"message_group.search\"}", "type": [ "info" ] }, "http": { "request": { - "id": "ca817b01-cfaa-40ea-ab80-30b6a8e6ef08", + "id": "6ad202de-0def-423d-a0f2-549402e1a9c9", "method": "GET" } }, "input": { - "type": "aws-s3" - }, - "log": { - "file": { - "path": "https://elastic-package-sublime-audit-bucket-83544.s3.us-east-1.amazonaws.com/test-audit.log" - }, - "offset": 1 + "type": "cel" }, "observer": { "product": "Sublime Security", @@ -153,63 +136,65 @@ An example event for `audit` looks as following: }, "related": { "ip": [ - "81.2.69.142" + "1.128.0.0" ], "user": [ - "bob@example.com", - "Bob", - "6e6eca05-4fea-406b-86d4-b40177e25474" + "demo@example.com", + "Demo", + "d83rb8et4-refe-fe7t4f8efe", + "6e6eca05-4fea-406b-86d4-b40177e25474", + "fhe7t4bgf8-freu-ebfur94ref" ] }, "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142" + "ip": "1.128.0.0" }, "sublime_security": { "audit": { + "created_at": "2024-08-12T06:04:03.714Z", "created_by": { "active": true, "created_at": "2024-07-12T05:13:47.879Z", - "first_name": "Bob", + "email_address": "demo@example.com", + "first_name": "Demo", + "google_oauth_user_id": "d83rb8et4-refe-fe7t4f8efe", + "id": "6e6eca05-4fea-406b-86d4-b40177e25474", "is_enrolled": true, "last_name": "User", + "microsoft_oauth_user_id": "fhe7t4bgf8-freu-ebfur94ref", + "role": "admin", "updated_at": "2024-07-12T05:13:47.879Z" }, "data": { "request": { - "api_key_name": "demo mode key", - "authentication_method": "api_key" + "api_key_name": "demo mode local", + "authentication_method": "api_key", + "id": "6ad202de-0def-423d-a0f2-549402e1a9c9", + "ip": "1.128.0.0", + "method": "GET", + "path": "/v0/message-groups", + "user_agent": "Go-http-client/1.1" } }, + "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", "type": "message_group.search" } }, "tags": [ - "collect_sqs_logs", "preserve_original_event", + "preserve_duplicate_custom_fields", "forwarded", "sublime_security-audit" ], "url": { - "path": "/v1/messages/groups/search" + "path": "/v0/message-groups" }, "user": { "domain": "example.com", - "email": "bob@example.com", - "full_name": "Bob User", + "email": "demo@example.com", + "full_name": "Demo User", "id": "6e6eca05-4fea-406b-86d4-b40177e25474", - "name": "bob", + "name": "demo", "roles": [ "admin" ] @@ -218,14 +203,9 @@ An example event for `audit` looks as following: "device": { "name": "Other" }, - "name": "Chrome", - "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", - "os": { - "full": "Windows 10", - "name": "Windows", - "version": "10" - }, - "version": "126.0.0.0" + "name": "Go-http-client", + "original": "Go-http-client/1.1", + "version": "1.1" } } ``` diff --git a/packages/sublime_security/manifest.yml b/packages/sublime_security/manifest.yml index 107c3f1d883..0578f84a2d0 100644 --- a/packages/sublime_security/manifest.yml +++ b/packages/sublime_security/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.3.2 name: sublime_security title: Sublime Security -version: "1.12.1" +version: "1.12.2" description: Collect logs from Sublime Security with Elastic Agent. type: integration categories: From 98dacb3659dcc3f2da45e03649365b1341c357bc Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Wed, 22 Jul 2026 13:33:25 +0530 Subject: [PATCH 2/9] add missing event categorization for google_workspace data stream --- .../_dev/deploy/docker/docker-compose.yml | 9 +- packages/google_workspace/changelog.yml | 5 + .../pipeline/test-calendar.log-expected.json | 9 + .../elasticsearch/ingest_pipeline/default.yml | 11 + .../data_stream/calendar/sample_event.json | 18 +- .../test/pipeline/test-chat.log-expected.json | 12 + .../elasticsearch/ingest_pipeline/default.yml | 6 + .../data_stream/chat/sample_event.json | 18 +- .../pipeline/test-chrome.log-expected.json | 48 +++- .../elasticsearch/ingest_pipeline/default.yml | 14 +- .../data_stream/chrome/sample_event.json | 23 +- ...est-context-aware-access.log-expected.json | 13 +- .../elasticsearch/ingest_pipeline/default.yml | 22 +- .../context_aware_access/sample_event.json | 18 +- .../pipeline/test-device.log-expected.json | 28 +- .../elasticsearch/ingest_pipeline/default.yml | 124 ++++++++- .../data_stream/device/sample_event.json | 29 +- .../test/pipeline/test-gcp.log-expected.json | 12 +- .../elasticsearch/ingest_pipeline/default.yml | 33 ++- .../data_stream/gcp/sample_event.json | 26 +- .../test-group-enterprise.log-expected.json | 14 +- .../elasticsearch/ingest_pipeline/default.yml | 45 ++- .../group_enterprise/sample_event.json | 28 +- .../test/pipeline/test-keep.log-expected.json | 6 + .../elasticsearch/ingest_pipeline/default.yml | 7 +- .../data_stream/keep/sample_event.json | 21 +- .../elasticsearch/ingest_pipeline/default.yml | 14 +- .../data_stream/login/sample_event.json | 14 +- .../test/pipeline/test-meet.log-expected.json | 18 ++ .../elasticsearch/ingest_pipeline/default.yml | 22 +- .../data_stream/meet/sample_event.json | 21 +- .../pipeline/test-rules.log-expected.json | 20 +- .../elasticsearch/ingest_pipeline/default.yml | 37 ++- .../data_stream/rules/sample_event.json | 24 +- .../pipeline/test-vault.log-expected.json | 3 + .../elasticsearch/ingest_pipeline/default.yml | 7 + .../data_stream/vault/sample_event.json | 18 +- packages/google_workspace/docs/README.md | 258 ++++++++++-------- packages/google_workspace/manifest.yml | 2 +- 39 files changed, 780 insertions(+), 277 deletions(-) diff --git a/packages/google_workspace/_dev/deploy/docker/docker-compose.yml b/packages/google_workspace/_dev/deploy/docker/docker-compose.yml index d75723e84a4..458c7e5e964 100644 --- a/packages/google_workspace/_dev/deploy/docker/docker-compose.yml +++ b/packages/google_workspace/_dev/deploy/docker/docker-compose.yml @@ -15,6 +15,12 @@ services: echo "This puts the generated private key into a single string that can be interpolated in the credentials file."; awk -v var="$$(sed -E ':a;N;$$!ba;s/\r{0,1}\n/\\\\n/g' pkcs8.key)" '{sub(/the-key/,var)}1' /credentials.json > /config/credentials.json; sleep 1000 + healthcheck: + test: ["CMD-SHELL", "test -f /config/credentials.json"] + interval: 2s + timeout: 2s + retries: 90 + start_period: 3s google_workspace: image: docker.elastic.co/observability/stream:v0.18.0 hostname: google_workspace @@ -29,4 +35,5 @@ services: - --addr=:8080 - --config=/config.yml depends_on: - - creds + creds: + condition: service_healthy diff --git a/packages/google_workspace/changelog.yml b/packages/google_workspace/changelog.yml index 2daa77e5b9b..26949b1506a 100644 --- a/packages/google_workspace/changelog.yml +++ b/packages/google_workspace/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.5.1" + changes: + - description: Add missing ECS event categorization for the gcp, rules, calendar, group_enterprise, context_aware_access, meet, chat, chrome, login, device, keep, and vault data streams. + type: bugfix + link: https://github.com/elastic/integrations/issues/1 - version: "3.5.0" changes: - description: Reduce default lag times for login, gcp, user_accounts, groups, group_enterprise, and calendar data streams to align with Google documented reporting delays. diff --git a/packages/google_workspace/data_stream/calendar/_dev/test/pipeline/test-calendar.log-expected.json b/packages/google_workspace/data_stream/calendar/_dev/test/pipeline/test-calendar.log-expected.json index a1f6eec217f..ff3814b1072 100644 --- a/packages/google_workspace/data_stream/calendar/_dev/test/pipeline/test-calendar.log-expected.json +++ b/packages/google_workspace/data_stream/calendar/_dev/test/pipeline/test-calendar.log-expected.json @@ -320,6 +320,9 @@ }, "event": { "action": "print-preview-event", + "category": [ + "configuration" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-04-01T07:13:18.495Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"calendar\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"ownerDomain\": \"elastic.com\", \"ipAddress\": \"67.43.156.13\", \"events\": {\"type\": \"event_change\", \"name\": \"print_preview_event\", \"parameters\": [{\"name\": \"event_id\", \"value\": \"abc123\"}, {\"name\": \"calendar_id\", \"value\": \"foo@bar.com\"}, {\"name\": \"event_title\", \"value\": \"Test Event\"}, {\"name\": \"recurring\", \"value\": \"no\"}, {\"name\": \"client_side_encrypted\", \"value\": \"no\"}, {\"name\": \"api_kind\", \"value\": \"web\"}, {\"name\": \"user_agent\", \"value\": \"Mozilla/5.0\"}]}}", @@ -1547,6 +1550,9 @@ }, "event": { "action": "export-calendar", + "category": [ + "configuration" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-04-01T06:58:04.206Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"calendar\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"ownerDomain\": \"elastic.com\", \"ipAddress\": \"67.43.156.13\", \"events\": {\"type\": \"calendar_change\", \"name\": \"export_calendar\", \"parameters\": [{\"name\": \"calendar_id\", \"value\": \"c_abc123@group.calendar.google.com\"}, {\"name\": \"api_kind\", \"value\": \"web\"}, {\"name\": \"user_agent\", \"value\": \"Mozilla/5.0\"}]}}", @@ -2110,6 +2116,9 @@ }, "event": { "action": "interop-freebusy-lookup-outbound-successful", + "category": [ + "configuration" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-28T07:41:12.671Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"calendar\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"ownerDomain\": \"elastic.com\", \"events\": {\"type\": \"interop\", \"name\": \"interop_freebusy_lookup_outbound_successful\", \"parameters\": [{\"name\": \"api_kind\", \"value\": \"web\"}, {\"name\": \"calendar_id\", \"value\": \"foo@bar.com\"}, {\"name\": \"remote_ews_url\", \"value\": \"https://exchange.example.com/EWS/Exchange.asmx\"}, {\"name\": \"requested_period_start\", \"intValue\": \"1743748267\"}, {\"name\": \"requested_period_end\", \"intValue\": \"1743748267\"}]}}", diff --git a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml index 4fbd9c0fc9a..4b1dd60d1f5 100644 --- a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml @@ -108,7 +108,9 @@ processors: create_calendar: configuration delete_calendar: configuration change_calendar_description: configuration + export_calendar: configuration change_calendar_location: configuration + print_preview_calendar: configuration change_calendar_timezone: configuration change_calendar_title: configuration add_subscription: configuration @@ -123,12 +125,21 @@ processors: remove_event_guest: configuration change_event_guest_response: configuration change_event: configuration + print_preview_event: configuration remove_event_from_trash: configuration restore_event: configuration change_event_start_time: configuration change_event_title: configuration transfer_event_completed: configuration transfer_event_requested: configuration + interop_freebusy_lookup_outbound_successful: configuration + interop_freebusy_lookup_inbound_successful: configuration + interop_exchange_resource_availability_lookup_successful: configuration + interop_exchange_resource_list_lookup_successful: configuration + interop_freebusy_lookup_outbound_unsuccessful: configuration + interop_freebusy_lookup_inbound_unsuccessful: configuration + interop_exchange_resource_availability_lookup_unsuccessful: configuration + interop_exchange_resource_list_lookup_unsuccessful: configuration source: |- ctx.event = ctx.event ?: [:]; def category = []; diff --git a/packages/google_workspace/data_stream/calendar/sample_event.json b/packages/google_workspace/data_stream/calendar/sample_event.json index a9163013ee4..140d84b3af9 100644 --- a/packages/google_workspace/data_stream/calendar/sample_event.json +++ b/packages/google_workspace/data_stream/calendar/sample_event.json @@ -1,24 +1,24 @@ { "@timestamp": "2025-04-01T07:00:40.262Z", "agent": { - "ephemeral_id": "c496161a-177e-4359-8324-e11405aeeaad", - "id": "1ab21f00-c503-4805-b1de-01dacd186aef", - "name": "elastic-agent-44155", + "ephemeral_id": "bff7fec7-4d40-45ad-be16-632427fab559", + "id": "b3774315-d26c-4bf5-9778-d470566fab35", + "name": "elastic-agent-85176", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.calendar", - "namespace": "50432", + "namespace": "40687", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "1ab21f00-c503-4805-b1de-01dacd186aef", - "snapshot": true, - "version": "8.18.0" + "id": "b3774315-d26c-4bf5-9778-d470566fab35", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "delete-calendar", @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.calendar", "id": "1", - "ingested": "2025-04-22T12:01:05Z", + "ingested": "2026-07-22T07:07:30Z", "kind": "event", "original": "{\"actor\":{\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"delete_calendar\",\"parameters\":[{\"name\":\"calendar_id\",\"value\":\"c_abc123@group.calendar.google.com\"},{\"name\":\"api_kind\",\"value\":\"web\"},{\"name\":\"user_agent\",\"value\":\"Mozilla/5.0\"}],\"type\":\"calendar_change\"},\"id\":{\"applicationName\":\"calendar\",\"customerId\":\"1\",\"time\":\"2025-04-01T07:00:40.262Z\",\"uniqueQualifier\":\"1\"},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "calendar", diff --git a/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json b/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json index d4b27646849..98ca480bde2 100644 --- a/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json +++ b/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json @@ -239,6 +239,9 @@ }, "event": { "action": "invite-accept", + "category": [ + "configuration" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-26T05:53:45.936Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"chat\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"invite_accept\", \"parameters\": [{\"name\": \"room_id\", \"value\": \"1\"}, {\"name\": \"actor\", \"value\": \"foo@bar.com\"}, {\"name\": \"room_name\", \"value\": \"TEST 2\"}, {\"name\": \"external_room\", \"value\": \"DISABLED\"}, {\"name\": \"actor_type\", \"value\": \"NON_ADMIN\"}, {\"name\": \"conversation_type\", \"value\": \"SPACE\"}, {\"name\": \"conversation_ownership\", \"value\": \"INTERNALLY_OWNED\"}]}}", @@ -612,6 +615,9 @@ }, "event": { "action": "custom-status-updated", + "category": [ + "configuration" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-26T05:44:13.080Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"chat\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"custom_status_updated\", \"parameters\": [{\"name\": \"actor\", \"value\": \"foo@bar.com\"}, {\"name\": \"actor_type\", \"value\": \"NON_ADMIN\"}]}}", @@ -1205,6 +1211,9 @@ }, "event": { "action": "attachment-download", + "category": [ + "file" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:19:50.145Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"chat\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"attachment_download\", \"parameters\": [{\"name\": \"actor\", \"value\": \"foo@bar.com\"}, {\"name\": \"room_id\", \"value\": \"1\"}, {\"name\": \"attachment_name\", \"value\": \"aW1hZ2UucG5n\"}, {\"name\": \"attachment_hash\", \"value\": \"1\"}, {\"name\": \"attachment_url\", \"value\": \"https://chat.elastic.com/download?attachment_token=1\"}]}}", @@ -1284,6 +1293,9 @@ }, "event": { "action": "attachment-upload", + "category": [ + "file" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:19:46.345Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"chat\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"attachment_upload\", \"parameters\": [{\"name\": \"room_id\", \"value\": \"1\"}, {\"name\": \"message_id\", \"value\": \"1\"}, {\"name\": \"actor\", \"value\": \"foo@bar.com\"}, {\"name\": \"attachment_name\", \"value\": \"image.png\"}, {\"name\": \"attachment_hash\", \"value\": \"1\"}, {\"name\": \"room_name\", \"value\": \"Self\"}, {\"name\": \"retention_state\", \"value\": \"PERMANENT\"}, {\"name\": \"external_room\", \"value\": \"DISABLED\"}, {\"name\": \"dlp_scan_status\", \"value\": \"DLP_NOT_APPLICABLE\"}, {\"name\": \"actor_type\", \"value\": \"NON_ADMIN\"}, {\"name\": \"conversation_type\", \"value\": \"SPACE\"}, {\"name\": \"conversation_ownership\", \"value\": \"INTERNALLY_OWNED\"}]}}", diff --git a/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml index 3c151e831f9..427f6cd2f5f 100644 --- a/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml @@ -107,12 +107,18 @@ processors: lang: painless params: add_room_member: configuration + attachment_download: file + attachment_upload: file block_room: configuration block_user: configuration + custom_status_updated: configuration emoji_created: configuration emoji_deleted: configuration history_turned_off: configuration history_turned_on: configuration + invite_accept: configuration + invite_decline: configuration + invite_send: configuration remove_room_member: configuration room_created: configuration room_deleted: configuration diff --git a/packages/google_workspace/data_stream/chat/sample_event.json b/packages/google_workspace/data_stream/chat/sample_event.json index 631c09fb6e8..a42db29b837 100644 --- a/packages/google_workspace/data_stream/chat/sample_event.json +++ b/packages/google_workspace/data_stream/chat/sample_event.json @@ -1,24 +1,24 @@ { "@timestamp": "2025-03-26T05:55:02.063Z", "agent": { - "ephemeral_id": "afc7ce98-0520-45e0-94c4-64274b308642", - "id": "411b5487-ebfa-4a91-89da-d7e59f3f1cd2", - "name": "elastic-agent-11706", + "ephemeral_id": "6449a9b1-d610-4094-960a-4e43c2c87006", + "id": "13ad2886-85c9-43e5-8293-9bd32dbf1657", + "name": "elastic-agent-40045", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chat", - "namespace": "37789", + "namespace": "80821", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "411b5487-ebfa-4a91-89da-d7e59f3f1cd2", - "snapshot": true, - "version": "8.18.0" + "id": "13ad2886-85c9-43e5-8293-9bd32dbf1657", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "room-name-updated", @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.chat", "id": "1", - "ingested": "2025-04-16T08:53:19Z", + "ingested": "2026-07-22T06:53:39Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\",\"events\":{\"name\":\"room_name_updated\",\"parameters\":[{\"name\":\"room_id\",\"value\":\"1\"},{\"name\":\"actor\",\"value\":\"foo@bar.com\"},{\"name\":\"room_name\",\"value\":\"TEST3\"},{\"name\":\"external_room\",\"value\":\"DISABLED\"},{\"name\":\"actor_type\",\"value\":\"NON_ADMIN\"},{\"name\":\"conversation_type\",\"value\":\"SPACE\"},{\"name\":\"conversation_ownership\",\"value\":\"INTERNALLY_OWNED\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"chat\",\"customerId\":\"1\",\"time\":\"2025-03-26T05:55:02.063Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "chat", diff --git a/packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json b/packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json index 290902679f6..b73d641b5bd 100644 --- a/packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json +++ b/packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json @@ -12,12 +12,18 @@ }, "event": { "action": "browser_extension_install", + "category": [ + "package" + ], "id": "-3640711002716937498", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh@example.io\",\"profileId\":\"10111170624712104\"},\"ipAddress\":\"81.2.69.142\",\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"laaaaaaafhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"abcdefgh\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "BROWSER_EXTENSION_INSTALL" + "reason": "BROWSER_EXTENSION_INSTALL", + "type": [ + "installation" + ] }, "google_workspace": { "chrome": { @@ -139,12 +145,18 @@ }, "event": { "action": "browser_extension_install", + "category": [ + "package" + ], "id": "7437587313655252416", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh@example.io\",\"profileId\":\"109689111170624712105\"},\"etag\":\"abcdefgh/o-xkjZa6siXSekffMWaLMCnKxpg\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905286\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"aaaaaaaaabokpmkimbfghdkjmjhdgbg\"},{\"name\":\"APP_NAME\",\"value\":\"Text\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"abcdefgh\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"0.8.4\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.286Z\",\"uniqueQualifier\":\"7437587313655252416\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "BROWSER_EXTENSION_INSTALL" + "reason": "BROWSER_EXTENSION_INSTALL", + "type": [ + "installation" + ] }, "google_workspace": { "chrome": { @@ -241,10 +253,16 @@ }, "event": { "action": "unsafe_site_visit", + "category": [ + "web" + ], "id": "7437587313655252416", "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh@example.io\",\"profileId\":\"109689111170624712105\"},\"etag\":\"abcdefgh/o-xkjZa6siXSekffMWaLMCnKxpg\",\"events\":{\"name\":\"UNSAFE_SITE_VISIT\",\"parameters\":[{\"name\":\"TAB_URL\",\"value\":\"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch\"}],\"type\":\"UNSAFE_SITE_VISIT_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.286Z\",\"uniqueQualifier\":\"7437587313655252416\"},\"kind\":\"admin#reports#activity\"}", - "provider": "chrome" + "provider": "chrome", + "type": [ + "info" + ] }, "google_workspace": { "chrome": { @@ -308,13 +326,19 @@ }, "event": { "action": "content_transfer", + "category": [ + "file" + ], "hash": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824", "id": "786234589762965922973", "kind": "event", "original": "{\"actor\":{\"callerType\":\"EXTERNAL_USER\",\"email\":\"test@example.com\"},\"etag\":\"akhsdbvkhsbfdhjkgvbkjfdbkgkjaLs/mLwhjbchkjDHKBDFHJVWESDJHFBg\",\"events\":{\"name\":\"CONTENT_TRANSFER\",\"parameters\":[{\"intValue\":\"1768254290648\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"CONTENT_MATCHED_SENSITIVE_DATA_TYPES\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"143.0.7499.193\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"0skhbf8fvhwe323z\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_BROWSER\"},{\"name\":\"CONTENT_HASH\",\"value\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\"},{\"name\":\"CONTENT_NAME\",\"value\":\"/Users/test/Downloads/Hello 1.10.pdf\"},{\"name\":\"CONTENT_RISK_LEVEL\",\"value\":\"CONTENT_RISK_LEVEL_UNSPECIFIED\"},{\"name\":\"CONTENT_TRANSFER_METHOD\",\"value\":\"UNKNOWN\"},{\"name\":\"CONTENT_TYPE\",\"value\":\"application/pdf\"},{\"name\":\"DEVICE_ID\",\"value\":\"A24352S553\"},{\"name\":\"DEVICE_NAME\",\"value\":\"CW-A35FV5SG56-U\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"Mac OS X 15.7\"},{\"name\":\"DEVICE_USER\",\"value\":\"test\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"dabcdef4-abcd-1234-5678-abcdef987654\"},{\"name\":\"EVENT_RESULT\",\"value\":\"DETECTED\"},{\"name\":\"LOCAL_IP\",\"value\":\"2a02:cf40:: , 192.168.1.154, 175.16.199.1, 1.128.0.1\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.com\"},{\"name\":\"PE_HASH\",\"value\":\"\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"test@example.com\"},{\"name\":\"REMOTE_IP\",\"value\":\"175.16.199.1\"},{\"name\":\"SCAN_ID\",\"value\":\"VUHSBKVJ749Y9827947289748927985789243YUTHFRHGF983HBFIYWGEBFUIWHF792YT7I4HRIU23NBFIU2BF927YRG92IHRB9UI2344BF9272U9GTFBI9WE7FH972IW\"},{\"name\":\"TAB_URL\",\"value\":\"chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://mail.google.com/mail/u/0?ui=2\\\\u0026ik=c52e896199\\\\u0026attid=0.1\\\\u0026permmsgid=msg-f:147958972487293\\\\u0026th=skhbvjhwbv7w898vws5\\\\u0026view=att\\\\u0026disp=inline\\\\u0026realattid=f_mkgrgersggw\\\\u0026zw\\\\u0026acrobatPromotionSource=gmail_chrome-card\"},{\"name\":\"TRIGGER_DESTINATION\",\"value\":\"\"},{\"name\":\"TRIGGER_SOURCE\",\"value\":\"\"},{\"name\":\"TRIGGER_TYPE\",\"value\":\"FILE_DOWNLOAD\"},{\"name\":\"URL\",\"value\":\"blob:chrome-extension://wbhubfwouhgboewrjbgwkjgbnowlgnolwgnolw/cabcdef0-abcd-ab12-5678-71234567890b\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36,gzip(gfe)\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"A245984769D45\"},{\"intValue\":\"89076\",\"name\":\"CONTENT_SIZE\"},{\"boolValue\":false,\"name\":\"IS_ENCRYPTED\"},{\"multiValue\":[\"https://acrobat.adobe.com/dc-chrome-extension/index.html?locale=en-US\\\\u0026logAnalytics=true\\\\u0026callingApp=efaegergegwhgwtrgegeqhrthbrtgbtrn\\\\u0026lfa=false\\\\u0026rvu=true\\\\u0026version=25.12.1.2%3Aupdate\\\\u0026installSource=sideload\"],\"name\":\"IFRAME_URLS\"},{\"multiMessageValue\":[{\"parameter\":[{\"name\":\"DETECTOR_ID\",\"value\":\"EMAIL_ADDRESS\"},{\"name\":\"DETECTOR_NAME\",\"value\":\"EMAIL_ADDRESS\"}]}],\"name\":\"MATCHED_DETECTORS\"},{\"multiMessageValue\":[{\"parameter\":[{\"name\":\"IFRAME_URL_CATEGORY_ENUM_TYPE\",\"value\":\"INTERNET_AND_TECHNOLOGY__SOFTWARE\"}]}],\"name\":\"NESTED_IFRAME_URL_CATEGORIES\"}],\"type\":\"CONTENT_TRANSFER_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"Jjkvbwskj848\",\"time\":\"2026-01-12T21:44:50.648Z\",\"uniqueQualifier\":\"786234589762965922973\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "CONTENT_MATCHED_SENSITIVE_DATA_TYPES" + "reason": "CONTENT_MATCHED_SENSITIVE_DATA_TYPES", + "type": [ + "info" + ] }, "google_workspace": { "chrome": { @@ -443,12 +467,18 @@ }, "event": { "action": "content_transfer", + "category": [ + "file" + ], "hash": "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3", "id": "111999888777666555", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"firstname.lastname@example.com\",\"profileId\":\"111222333444555666\"},\"etag\":\"akhsdbvkhsbfdhjkgvbkjfdbkgkjaLs/wINdOwSdOmAiNtEsT0001ExAmPlE\",\"events\":{\"name\":\"CONTENT_TRANSFER\",\"parameters\":[{\"intValue\":\"1740820500000\",\"name\":\"TIMESTAMP\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_BROWSER\"},{\"name\":\"CONTENT_HASH\",\"value\":\"a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3\"},{\"name\":\"CONTENT_NAME\",\"value\":\"C:\\\\Users\\\\firstname.lastname\\\\Documents\\\\secret.pdf\"},{\"name\":\"CONTENT_SIZE\",\"intValue\":\"54321\"},{\"name\":\"CONTENT_TYPE\",\"value\":\"application/pdf\"},{\"boolValue\":false,\"name\":\"IS_ENCRYPTED\"},{\"name\":\"DEVICE_NAME\",\"value\":\"MYHOST\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"Windows 11\"},{\"name\":\"DEVICE_USER\",\"value\":\"MYHOST\\\\firstname.lastname\"},{\"name\":\"EVENT_RESULT\",\"value\":\"BLOCKED\"},{\"name\":\"LOCAL_IP\",\"value\":\"192.168.10.50\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"firstname.lastname@example.com\"},{\"name\":\"REMOTE_IP\",\"value\":\"198.51.100.1\"},{\"name\":\"TRIGGER_TYPE\",\"value\":\"FILE_UPLOAD\"}],\"type\":\"CONTENT_TRANSFER_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"CWIN123456\",\"time\":\"2026-03-01T09:15:00.000Z\",\"uniqueQualifier\":\"111999888777666555\"},\"kind\":\"admin#reports#activity\"}", "outcome": "failure", - "provider": "chrome" + "provider": "chrome", + "type": [ + "info" + ] }, "google_workspace": { "chrome": { @@ -544,12 +574,18 @@ }, "event": { "action": "content_transfer", + "category": [ + "file" + ], "hash": "b3a8e0e1f9ab1bfe3a36f231f676f78bb28a2b31df895b39b4d9c967f2f3a16b", "id": "222888777666555444", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"jdoe@example.com\",\"profileId\":\"222333444555666777\"},\"etag\":\"akhsdbvkhsbfdhjkgvbkjfdbkgkjaLs/cOrPdOmAiNtEsT0002ExAmPlE\",\"events\":{\"name\":\"CONTENT_TRANSFER\",\"parameters\":[{\"intValue\":\"1740924000000\",\"name\":\"TIMESTAMP\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_BROWSER\"},{\"name\":\"CONTENT_HASH\",\"value\":\"b3a8e0e1f9ab1bfe3a36f231f676f78bb28a2b31df895b39b4d9c967f2f3a16b\"},{\"name\":\"CONTENT_NAME\",\"value\":\"C:\\\\Users\\\\jdoe\\\\Desktop\\\\budget.xlsx\"},{\"name\":\"CONTENT_SIZE\",\"intValue\":\"98765\"},{\"name\":\"CONTENT_TYPE\",\"value\":\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\"},{\"boolValue\":true,\"name\":\"IS_ENCRYPTED\"},{\"name\":\"DEVICE_NAME\",\"value\":\"CORPWS001\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"Windows 11\"},{\"name\":\"DEVICE_USER\",\"value\":\"CORP\\\\jdoe@example.com\"},{\"name\":\"EVENT_RESULT\",\"value\":\"BLOCKED\"},{\"name\":\"LOCAL_IP\",\"value\":\"10.10.10.25\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"jdoe@example.com\"},{\"name\":\"REMOTE_IP\",\"value\":\"198.51.100.2\"},{\"name\":\"TRIGGER_TYPE\",\"value\":\"FILE_UPLOAD\"}],\"type\":\"CONTENT_TRANSFER_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"CWIN789012\",\"time\":\"2026-03-02T14:00:00.000Z\",\"uniqueQualifier\":\"222888777666555444\"},\"kind\":\"admin#reports#activity\"}", "outcome": "failure", - "provider": "chrome" + "provider": "chrome", + "type": [ + "info" + ] }, "google_workspace": { "chrome": { diff --git a/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml index ac24f1c75bb..376ac921671 100644 --- a/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml @@ -130,16 +130,21 @@ processors: tag: set_event_category_from_chrome_name lang: painless params: + browser_extension_install: package chrome_os_add_user: iam chrome_os_remove_user: iam - device_boot_state_change: configuration chrome_os_login_failure_event: authentication chrome_os_login_logout_event: authentication chrome_os_login_event: authentication chrome_os_logout_event: authentication + content_transfer: file + device_boot_state_change: configuration extension_request: configuration login_event: authentication malware_transfer: malware + password_breach: authentication + sensitive_data_transfer: file + unsafe_site_visit: web source: |- if (ctx.event == null) { ctx.event = new HashMap(); @@ -157,16 +162,21 @@ processors: tag: set_event_type_from_chrome_name lang: painless params: + browser_extension_install: installation chrome_os_add_user: creation chrome_os_remove_user: deletion - device_boot_state_change: change chrome_os_login_failure_event: info chrome_os_login_logout_event: info chrome_os_login_event: start chrome_os_logout_event: end + content_transfer: info + device_boot_state_change: change extension_request: info login_event: info malware_transfer: info + password_breach: info + sensitive_data_transfer: info + unsafe_site_visit: info source: |- if (ctx.event == null) { ctx.event = new HashMap(); diff --git a/packages/google_workspace/data_stream/chrome/sample_event.json b/packages/google_workspace/data_stream/chrome/sample_event.json index eb2bdf5688b..9974987e809 100644 --- a/packages/google_workspace/data_stream/chrome/sample_event.json +++ b/packages/google_workspace/data_stream/chrome/sample_event.json @@ -1,15 +1,15 @@ { "@timestamp": "2024-12-09T14:18:25.405Z", "agent": { - "ephemeral_id": "5e3c65b6-9b4b-4f04-adaa-cc64f98c8310", - "id": "529394dd-d27c-464d-9215-01b83c09d076", - "name": "elastic-agent-85230", + "ephemeral_id": "2b7f7f2f-6c69-4d6b-8edd-948ca3c6f110", + "id": "21d74789-d99d-4dfe-af4a-2288b3a564de", + "name": "elastic-agent-48415", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chrome", - "namespace": "32993", + "namespace": "80177", "type": "logs" }, "device": { @@ -21,21 +21,27 @@ "version": "8.16.0" }, "elastic_agent": { - "id": "529394dd-d27c-464d-9215-01b83c09d076", + "id": "21d74789-d99d-4dfe-af4a-2288b3a564de", "snapshot": false, "version": "8.19.4" }, "event": { "action": "browser_extension_install", "agent_id_status": "verified", + "category": [ + "package" + ], "dataset": "google_workspace.chrome", "id": "-3640711002716937498", - "ingested": "2026-01-21T12:47:55Z", + "ingested": "2026-07-22T06:55:21Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh.kumar@example.io\",\"profileId\":\"109689693170624712102\"},\"etag\":\"\\\"CfV-pEPVZc7PJf2fWsHJTliD34MdGbO8iFIk3L4uBwQ/cBsNSJx2A9Lg8kiQCGLddmq827A\\\"\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"lmjegmlicamnimmfhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"02gajno12larrqx\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "BROWSER_EXTENSION_INSTALL" + "reason": "BROWSER_EXTENSION_INSTALL", + "type": [ + "installation" + ] }, "google_workspace": { "chrome": { @@ -93,7 +99,8 @@ "related": { "user": [ "kalpesh.kumar@example.io", - "109689693170624712102" + "109689693170624712102", + "kalpesh.kumar" ] }, "source": { diff --git a/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json b/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json index 560d8e9d61a..593b34e705e 100644 --- a/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json +++ b/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json @@ -7,12 +7,17 @@ }, "event": { "action": "ACCESS_DENY_EVENT", - "id": "-6709442587437772138", - "kind": [ - "event" + "category": [ + "network" ], + "id": "-6709442587437772138", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"etag\":\"\\\"CTyc505ppdmJR2motHVsU17kzItOkPo5vYViqlSF0rU/_JGuGElaExAZGVCsPXBMf-HkFqo\\\"\",\"events\":{\"type\":\"context_aware_access\",\"name\":\"ACCESS_DENY_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}]},\"id\":{\"applicationName\":\"token\",\"customerId\":\"C02umwv6u\",\"time\":\"2023-01-01T06:24:42.442Z\",\"uniqueQualifier\":\"-6709442587437772138\"},\"ipAddress\":\"89.160.20.112\",\"kind\":\"admin#reports#activity\"}", - "provider": "token" + "outcome": "failure", + "provider": "token", + "type": [ + "denied" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml index d21e19108a3..6c050d7c364 100644 --- a/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml @@ -36,9 +36,6 @@ processors: if: ctx.json?.events == null description: Discard events that are missing the target during the split operation and are subsequently returned as the root object. tag: drop_empty_events - - set: - field: event.kind - value: [event] - date: field: json.id.time if: ctx.json?.id?.time != null && ctx.json.id.time != '' @@ -333,6 +330,25 @@ processors: field: google_workspace.context_aware_access.CAA_DEVICE_STATE target_field: google_workspace.context_aware_access.device.state ignore_missing: true + - set: + field: event.kind + tag: set_event_kind + value: event + - append: + field: event.category + tag: append_network_into_event_category + value: network + if: ctx.event?.action != null && ["ACCESS_DENY_EVENT","ACCESS_DENY_INTERNAL_ERROR_EVENT","MONITOR_MODE_ACCESS_DENY_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_denied_into_event_type + value: denied + if: ctx.event?.action != null && ["ACCESS_DENY_EVENT","ACCESS_DENY_INTERNAL_ERROR_EVENT","MONITOR_MODE_ACCESS_DENY_EVENT"].contains(ctx.event.action) + - set: + field: event.outcome + tag: set_event_outcome_to_failure + value: failure + if: ctx.event?.action != null && ["ACCESS_DENY_EVENT","ACCESS_DENY_INTERNAL_ERROR_EVENT","MONITOR_MODE_ACCESS_DENY_EVENT"].contains(ctx.event.action) - remove: field: - json diff --git a/packages/google_workspace/data_stream/context_aware_access/sample_event.json b/packages/google_workspace/data_stream/context_aware_access/sample_event.json index ce449ad007a..a7536b53f08 100644 --- a/packages/google_workspace/data_stream/context_aware_access/sample_event.json +++ b/packages/google_workspace/data_stream/context_aware_access/sample_event.json @@ -1,35 +1,33 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "98e152de-6cca-41b4-a96c-7d524ad1d520", - "id": "e28183dc-9502-4bc0-b6f9-057d8093d53f", - "name": "elastic-agent-23811", + "ephemeral_id": "3a36557f-f0d1-4a59-8361-19a8609a8d7a", + "id": "65ce985f-497e-456d-b6d8-e0c0f3864a08", + "name": "elastic-agent-64228", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.context_aware_access", - "namespace": "31084", + "namespace": "65428", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "e28183dc-9502-4bc0-b6f9-057d8093d53f", + "id": "65ce985f-497e-456d-b6d8-e0c0f3864a08", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2025-12-08T04:33:03.762Z", + "created": "2026-07-22T06:56:35.154Z", "dataset": "google_workspace.context_aware_access", "id": "1", - "ingested": "2025-12-08T04:33:06Z", - "kind": [ - "event" - ], + "ingested": "2026-07-22T06:56:38Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "provider": "device" }, diff --git a/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json b/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json index 6d62e066bbf..d8caeec09df 100644 --- a/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json +++ b/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json @@ -7,12 +7,19 @@ }, "event": { "action": "APPLICATION_EVENT", - "id": "1", - "kind": [ - "event" + "category": [ + "host", + "package" ], + "id": "1", + "kind": "event", "original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"example.com\",\"ipAddress\":\"67.43.156.13\",\"etag\":\"string\",\"events\":{\"type\":\"device_applications\",\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}]}}", - "provider": "login" + "outcome": "failure", + "provider": "login", + "type": [ + "change", + "installation" + ] }, "google_workspace": { "actor": { @@ -171,12 +178,17 @@ }, "event": { "action": "DEVICE_SYNC_EVENT", - "id": "1", - "kind": [ - "event" + "category": [ + "host" ], + "id": "1", + "kind": "event", "original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"example.com\",\"ipAddress\":\"67.43.156.13\",\"etag\":\"string\",\"events\":{\"type\":\"device_updates\",\"name\":\"DEVICE_SYNC_EVENT\",\"parameters\":[{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"LAST_SYNC_AUDIT_DATE\",\"value\":\"1731689445476\"}]}}", - "provider": "login" + "provider": "login", + "type": [ + "change", + "info" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml index 702c27a275c..f783de69787 100644 --- a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml @@ -36,9 +36,6 @@ processors: if: ctx.json?.events == null description: Discard events that are missing the target during the split operation and are subsequently returned as the root object. tag: drop_empty_events - - set: - field: event.kind - value: [event] - date: field: json.id.time if: ctx.json?.id?.time != null && ctx.json.id.time != '' @@ -533,6 +530,127 @@ processors: field: google_workspace.device.WINDOWS_SYNCML_POLICY_STATUS_CODE target_field: google_workspace.device.windows_syncml_policy_status_code ignore_missing: true + - append: + field: event.category + tag: append_host_into_event_category + value: host + - set: + field: event.kind + tag: set_event_kind + value: event + - set: + field: event.kind + tag: set_event_kind_to_alert + value: alert + if: ctx.event?.action != null && ["DEVICE_COMPROMISED_EVENT", "SUSPICIOUS_ACTIVITY_EVENT"].contains(ctx.event.action) + - append: + field: event.category + tag: append_authentication_into_event_category + value: authentication + if: ctx.event?.action != null && ctx.event.action == "FAILED_PASSWORD_ATTEMPTS_EVENT" + - append: + field: event.category + tag: append_malware_into_event_category + value: malware + if: ctx.event?.action != null && ["SUSPICIOUS_ACTIVITY_EVENT", "APPLICATION_REPORT_EVENT"].contains(ctx.event.action) + - append: + field: event.category + tag: append_threat_into_event_category + value: threat + if: ctx.event?.action != null && ["DEVICE_COMPROMISED_EVENT", "SUSPICIOUS_ACTIVITY_EVENT"].contains(ctx.event.action) + - append: + field: event.category + tag: append_package_into_event_category + value: package + if: ctx.event?.action != null && ctx.event.action == "APPLICATION_EVENT" + - append: + field: event.type + tag: append_change_into_event_type + value: change + if: ctx.event?.action != null && ["APPLICATION_EVENT", "DEVICE_ACTION_EVENT", "DEVICE_COMPLIANCE_CHANGED_EVENT", "OS_UPDATED_EVENT", "DEVICE_OWNERSHIP_CHANGE_EVENT", "DEVICE_SETTINGS_UPDATED_EVENT", "ADVANCED_POLICY_SYNC_EVENT", "RISK_SIGNAL_UPDATED_EVENT", "ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT", "APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT", "DEVICE_SYNC_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type + value: info + if: ctx.event?.action != null && ["DEVICE_SYNC_EVENT", "APPLICATION_REPORT_EVENT", "SUSPICIOUS_ACTIVITY_EVENT", "FAILED_PASSWORD_ATTEMPTS_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_indicator_into_event_type + value: indicator + if: ctx.event?.action != null && ["DEVICE_COMPROMISED_EVENT", "SUSPICIOUS_ACTIVITY_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_start_into_event_type + value: start + if: ctx.event?.action != null && ctx.event.action == "DEVICE_REGISTER_UNREGISTER_EVENT" && ctx.google_workspace?.device?.account_state != null && ctx.google_workspace.device.account_state.equalsIgnoreCase("REGISTERED") + - append: + field: event.type + tag: append_end_into_event_type + value: end + if: ctx.event?.action != null && ctx.event.action == "DEVICE_REGISTER_UNREGISTER_EVENT" && ctx.google_workspace?.device?.account_state != null && !ctx.google_workspace.device.account_state.equalsIgnoreCase("REGISTERED") + - append: + field: event.type + tag: append_installation_into_event_type + value: installation + if: ctx.event?.action != null && ctx.event.action == "APPLICATION_EVENT" && ctx.google_workspace?.device?.application?.state != null && ctx.google_workspace.device.application.state.equalsIgnoreCase("INSTALLED") + - append: + field: event.type + tag: append_application_deletion_into_event_type + value: deletion + if: ctx.event?.action != null && ctx.event.action == "APPLICATION_EVENT" && ctx.google_workspace?.device?.application?.state != null && (ctx.google_workspace.device.application.state.equalsIgnoreCase("REMOVED") || ctx.google_workspace.device.application.state.equalsIgnoreCase("UNINSTALLED")) + - set: + field: event.outcome + tag: set_event_outcome_to_success + value: success + if: >- + ctx.google_workspace?.device?.action?.execution_status != null && + (ctx.google_workspace.device.action.execution_status.equalsIgnoreCase('SUCCESS') || + ctx.google_workspace.device.action.execution_status.equalsIgnoreCase('ACTION_SUCCESS')) + - set: + field: event.outcome + tag: set_event_outcome_to_success_from_policy_sync + value: success + if: >- + ctx.google_workspace?.device?.policy?.sync?.result != null && + ctx.google_workspace.device.policy.sync.result.equalsIgnoreCase('POLICY_SYNC_SUCCEEDED') + - set: + field: event.outcome + tag: set_event_outcome_to_success_from_compliance + value: success + if: >- + ctx.google_workspace?.device?.compliance != null && + ctx.google_workspace.device.compliance.equalsIgnoreCase('COMPLIANT') + - set: + field: event.outcome + tag: set_event_outcome_to_failure + value: failure + if: >- + ctx.google_workspace?.device?.action?.execution_status != null && + (ctx.google_workspace.device.action.execution_status.contains('REJECT') || + ctx.google_workspace.device.action.execution_status.contains('FAIL')) + - set: + field: event.outcome + tag: set_event_outcome_to_failure_from_policy_sync + value: failure + if: >- + ctx.google_workspace?.device?.policy?.sync?.result != null && + (ctx.google_workspace.device.policy.sync.result.equalsIgnoreCase('POLICY_SYNC_ABORTED') || + ctx.google_workspace.device.policy.sync.result.equalsIgnoreCase('POLICY_SYNC_FAILED')) + - set: + field: event.outcome + tag: set_event_outcome_to_failure_from_compliance + value: failure + if: >- + ctx.google_workspace?.device?.compliance != null && + ctx.google_workspace.device.compliance.equalsIgnoreCase('NON_COMPLIANT') + - set: + field: event.outcome + tag: set_event_outcome_to_failure_from_password_attempts + value: failure + if: >- + ctx?.event?.action == "FAILED_PASSWORD_ATTEMPTS_EVENT" && + ctx.google_workspace?.device?.failed_passwd_attempts != null && + ctx.google_workspace.device.failed_passwd_attempts > 0 - foreach: field: user.email if: ctx.user?.email instanceof List diff --git a/packages/google_workspace/data_stream/device/sample_event.json b/packages/google_workspace/data_stream/device/sample_event.json index 3118286a812..ad734b650dd 100644 --- a/packages/google_workspace/data_stream/device/sample_event.json +++ b/packages/google_workspace/data_stream/device/sample_event.json @@ -1,37 +1,44 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "bd04308b-2f70-430a-883a-4e7cd10123d7", - "id": "10c458fc-acd6-4cca-8d04-2263ff81c7e6", - "name": "elastic-agent-75163", + "ephemeral_id": "fa7c7a33-e988-49e4-81ec-a86495301da8", + "id": "0092765f-1d94-4789-973f-de5714762cd5", + "name": "elastic-agent-50116", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.device", - "namespace": "34729", + "namespace": "12815", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "10c458fc-acd6-4cca-8d04-2263ff81c7e6", + "id": "0092765f-1d94-4789-973f-de5714762cd5", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2025-12-08T04:34:13.648Z", + "category": [ + "host", + "package" + ], + "created": "2026-07-22T06:57:43.273Z", "dataset": "google_workspace.device", "id": "1", - "ingested": "2025-12-08T04:34:16Z", - "kind": [ - "event" - ], + "ingested": "2026-07-22T06:57:46Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "outcome": "failure", + "provider": "device", + "type": [ + "change", + "installation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json b/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json index b5e0e62615d..991faf2b445 100644 --- a/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json +++ b/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json @@ -7,12 +7,16 @@ }, "event": { "action": "IMPORT_SSH_PUBLIC_KEY", - "id": "-6709442587437772138", - "kind": [ - "event" + "category": [ + "iam" ], + "id": "-6709442587437772138", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"etag\":\"\\\"CTyc505ppdmJR2motHVsU17kzItOkPo5vYViqlSF0rU/_JGuGElaExAZGVCsPXBMf-HkFqo\\\"\",\"events\":{\"type\":\"CLOUD_OSLOGIN\",\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"foo@bar.com\"}]},\"id\":{\"applicationName\":\"token\",\"customerId\":\"C02umwv6u\",\"time\":\"2023-01-01T06:24:42.442Z\",\"uniqueQualifier\":\"-6709442587437772138\"},\"ipAddress\":\"89.160.20.112\",\"kind\":\"admin#reports#activity\"}", - "provider": "token" + "provider": "token", + "type": [ + "creation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml index d78157218b8..e7ee7b7ba34 100644 --- a/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml @@ -38,7 +38,8 @@ processors: tag: drop_empty_events - set: field: event.kind - value: [event] + tag: set_event_kind + value: event - date: field: json.id.time if: ctx.json?.id?.time != null && ctx.json.id.time != '' @@ -238,6 +239,36 @@ processors: value: '{{{source.user.email}}}' if: ctx.source?.user?.name != null allow_duplicates: false + - append: + field: event.category + tag: append_iam_into_event_category + value: iam + if: ctx?.event?.action != null + - append: + field: event.type + tag: append_creation_into_event_type + value: creation + if: ctx.event?.action != null && ["IMPORT_SSH_PUBLIC_KEY"].contains(ctx.event.action) + - append: + field: event.type + tag: append_deletion_into_event_type + value: deletion + if: ctx.event?.action != null && ["DELETE_POSIX_ACCOUNT","DELETE_SSH_PUBLIC_KEY"].contains(ctx.event.action) + - append: + field: event.type + tag: append_access_into_event_type + value: access + if: ctx.event?.action != null && ["GET_SSH_PUBLIC_KEY","GET_LOGIN_PROFILE"].contains(ctx.event.action) + - append: + field: event.type + tag: append_change_into_event_type + value: change + if: ctx.event?.action != null && ["UPDATE_SSH_PUBLIC_KEY"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type_for_unknown_gcp_action + value: info + if: ctx.event?.action != null && !["IMPORT_SSH_PUBLIC_KEY","DELETE_POSIX_ACCOUNT","DELETE_SSH_PUBLIC_KEY","GET_SSH_PUBLIC_KEY","GET_LOGIN_PROFILE","UPDATE_SSH_PUBLIC_KEY"].contains(ctx.event.action) - script: lang: painless description: Map Event parameters into key value pair. diff --git a/packages/google_workspace/data_stream/gcp/sample_event.json b/packages/google_workspace/data_stream/gcp/sample_event.json index e035b664391..cdda850af0e 100644 --- a/packages/google_workspace/data_stream/gcp/sample_event.json +++ b/packages/google_workspace/data_stream/gcp/sample_event.json @@ -1,37 +1,41 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "0505a3b2-62e8-4aef-a980-f0528788398b", - "id": "ee5f48ab-58d5-424d-97af-ce9077453cee", - "name": "elastic-agent-76346", + "ephemeral_id": "e462c95e-fc7b-4e8c-8e17-c078bbd6363a", + "id": "3be6ee34-e840-4202-a088-f8cbacd473b4", + "name": "elastic-agent-95567", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.gcp", - "namespace": "72783", + "namespace": "98644", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "ee5f48ab-58d5-424d-97af-ce9077453cee", + "id": "3be6ee34-e840-4202-a088-f8cbacd473b4", "snapshot": false, "version": "8.19.4" }, "event": { "action": "IMPORT_SSH_PUBLIC_KEY", "agent_id_status": "verified", - "created": "2025-12-08T04:36:32.150Z", + "category": [ + "iam" + ], + "created": "2026-07-22T06:59:03.390Z", "dataset": "google_workspace.gcp", "id": "1", - "ingested": "2025-12-08T04:36:35Z", - "kind": [ - "event" - ], + "ingested": "2026-07-22T06:59:06Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"foo@bar.com\"}],\"type\":\"CLOUD_OSLOGIN\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "provider": "device", + "type": [ + "creation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json b/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json index 19cbb8846cb..11f3715930b 100644 --- a/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json +++ b/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json @@ -7,12 +7,18 @@ }, "event": { "action": "add_info_setting", - "id": "1", - "kind": [ - "event" + "category": [ + "iam", + "configuration" ], + "id": "1", + "kind": "event", "original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"etag\":\"string\",\"events\":{\"type\":\"moderator_action\",\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}]}}", - "provider": "login" + "provider": "login", + "type": [ + "group", + "creation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml index 2f09e2a7162..47f3f1142e6 100644 --- a/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml @@ -36,9 +36,6 @@ processors: if: ctx.json?.events == null description: Discard events that are missing the target during the split operation and are subsequently returned as the root object. tag: drop_empty_events - - set: - field: event.kind - value: [event] - date: field: json.id.time if: ctx.json?.id?.time != null && ctx.json.id.time != '' @@ -192,6 +189,48 @@ processors: field: user.id copy_from: source.user.id ignore_empty_value: true + - append: + field: event.category + tag: append_iam_into_event_category + value: iam + - append: + field: event.type + tag: append_group_into_event_type + value: group + - set: + field: event.kind + tag: set_event_kind + value: event + - append: + field: event.category + tag: append_configuration_into_event_category + value: configuration + if: ctx.event?.action != null && ["add_info_setting", "remove_info_setting", "change_info_setting", "add_security_setting", "remove_security_setting", "change_security_setting", "change_security_setting_state", "add_service_account_permission", "remove_service_account_permission", "add_dynamic_group_query", "change_dynamic_group_query", "create_namespace", "delete_namespace"].contains(ctx.event.action) + - append: + field: event.type + tag: append_change_into_event_type + value: change + if: ctx.event?.action != null && ["change_info_setting", "change_security_setting", "change_security_setting_state", "change_dynamic_group_query", "update_membership_expiry", "approve_join_request", "join", "unban_member"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type + value: info + if: ctx.event?.action != null && ["accept_invitation", "request_to_join", "reject_invitation", "reject_join_request", "revoke_invitation", "invite_member", "ban_member_with_moderation"].contains(ctx.event.action) + - append: + field: event.type + tag: append_user_into_event_type + value: user + if: ctx.event?.action != null && ["accept_invitation", "add_member", "remove_member", "invite_member", "join", "reject_invitation", "reject_join_request", "request_to_join", "revoke_invitation", "ban_member_with_moderation", "unban_member", "approve_join_request"].contains(ctx.event.action) + - append: + field: event.type + tag: append_creation_into_event_type + value: creation + if: ctx.event?.action != null && ["create_group", "create_namespace", "add_info_setting", "add_security_setting", "add_service_account_permission", "add_member", "add_member_role", "add_dynamic_group_query", "add_membership_expiry", "invite_member"].contains(ctx.event.action) + - append: + field: event.type + tag: append_deletion_into_event_type + value: deletion + if: ctx.event?.action != null && ["delete_group", "delete_namespace", "remove_info_setting", "remove_security_setting", "remove_service_account_permission", "remove_member", "remove_member_role", "remove_membership_expiry", "revoke_invitation"].contains(ctx.event.action) - script: lang: painless description: Extract User name and User domain from Email. diff --git a/packages/google_workspace/data_stream/group_enterprise/sample_event.json b/packages/google_workspace/data_stream/group_enterprise/sample_event.json index e06396004e3..e54bd5dde64 100644 --- a/packages/google_workspace/data_stream/group_enterprise/sample_event.json +++ b/packages/google_workspace/data_stream/group_enterprise/sample_event.json @@ -1,37 +1,43 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "1e96a41d-fab8-4711-b3b7-2c80d7684821", - "id": "a4ef7a22-cfd6-4e87-aaa9-ea58e64ca9b3", - "name": "elastic-agent-82451", + "ephemeral_id": "6a987c97-d057-4150-91e1-a2bd50c5e6da", + "id": "18b072b8-ac88-483c-a90d-49c240a62c32", + "name": "elastic-agent-95571", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.group_enterprise", - "namespace": "18098", + "namespace": "54811", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "a4ef7a22-cfd6-4e87-aaa9-ea58e64ca9b3", + "id": "18b072b8-ac88-483c-a90d-49c240a62c32", "snapshot": false, "version": "8.19.4" }, "event": { "action": "add_info_setting", "agent_id_status": "verified", - "created": "2025-12-08T04:39:03.176Z", + "category": [ + "iam", + "configuration" + ], + "created": "2026-07-22T06:59:56.725Z", "dataset": "google_workspace.group_enterprise", "id": "1", - "ingested": "2025-12-08T04:39:06Z", - "kind": [ - "event" - ], + "ingested": "2026-07-22T06:59:59Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}],\"type\":\"moderator_action\"},\"id\":{\"applicationName\":\"group_enterprise\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "group_enterprise" + "provider": "group_enterprise", + "type": [ + "group", + "creation" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log-expected.json b/packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log-expected.json index 4450f93feed..9102f8887fa 100644 --- a/packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log-expected.json +++ b/packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log-expected.json @@ -79,6 +79,9 @@ }, "event": { "action": "deleted-attachment", + "category": [ + "file" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-27T12:46:29.430Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"keep\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"deleted_attachment\", \"parameters\": [{\"name\": \"owner_email\", \"value\": \"foo@bar.com\"}, {\"name\": \"note_name\", \"value\": \"https://keep.googleapis.com/v1/notes/abc-xyz\"}, {\"name\": \"attachment_name\", \"value\": \"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}]}}", @@ -149,6 +152,9 @@ }, "event": { "action": "uploaded-attachment", + "category": [ + "file" + ], "id": "0", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-27T12:45:08.310Z\", \"uniqueQualifier\": \"0\", \"applicationName\": \"keep\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"uploaded_attachment\", \"parameters\": [{\"name\": \"owner_email\", \"value\": \"foo@bar.com\"}, {\"name\": \"note_name\", \"value\": \"https://keep.googleapis.com/v1/notes/abc-xyz\"}, {\"name\": \"attachment_name\", \"value\": \"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}]}}", diff --git a/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml index cfd801f88a3..c28dca3f3c1 100644 --- a/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml @@ -95,9 +95,14 @@ processors: value: event - append: field: event.category - tag: set_iam_into_event_category + tag: append_iam_into_event_category value: iam if: ctx.google_workspace?.keep?.name == "modified_acl" + - append: + field: event.category + tag: append_file_into_event_category + value: file + if: ctx.google_workspace?.keep?.name != null && ["uploaded_attachment", "deleted_attachment"].contains(ctx.google_workspace.keep.name) - script: description: Set event type based on event name. if: ctx.google_workspace?.keep?.name != null diff --git a/packages/google_workspace/data_stream/keep/sample_event.json b/packages/google_workspace/data_stream/keep/sample_event.json index 4f418e6140d..48b817ab56f 100644 --- a/packages/google_workspace/data_stream/keep/sample_event.json +++ b/packages/google_workspace/data_stream/keep/sample_event.json @@ -1,31 +1,34 @@ { "@timestamp": "2025-03-27T12:45:08.310Z", "agent": { - "ephemeral_id": "e43a76f4-47c9-40b4-b16e-547081b85cca", - "id": "d2812dfd-bd3b-46f8-b372-9357a26b4580", - "name": "elastic-agent-49635", + "ephemeral_id": "a1dc4da9-10b6-4671-b3d9-20f0c9558c3f", + "id": "a1731c07-db09-45af-aa19-cd51604e7136", + "name": "elastic-agent-87212", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.keep", - "namespace": "61415", + "namespace": "60175", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "d2812dfd-bd3b-46f8-b372-9357a26b4580", - "snapshot": true, - "version": "8.18.0" + "id": "a1731c07-db09-45af-aa19-cd51604e7136", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "uploaded-attachment", "agent_id_status": "verified", + "category": [ + "file" + ], "dataset": "google_workspace.keep", "id": "0", - "ingested": "2025-04-29T06:58:21Z", + "ingested": "2026-07-22T07:00:49Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\",\"events\":{\"name\":\"uploaded_attachment\",\"parameters\":[{\"name\":\"owner_email\",\"value\":\"foo@bar.com\"},{\"name\":\"note_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz\"},{\"name\":\"attachment_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"keep\",\"customerId\":\"1\",\"time\":\"2025-03-27T12:45:08.310Z\",\"uniqueQualifier\":\"0\"},\"kind\":\"admin#reports#activity\"}", "provider": "keep", diff --git a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml index 628a7a2c896..423f2779089 100644 --- a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml @@ -154,7 +154,7 @@ processors: - append: field: event.category value: iam - if: '["account_disabled_password_leak","2sv_disable","2sv_enroll","account_disabled_generic","account_disabled_spamming_through_relay","account_disabled_spamming","account_disabled_hijacked","titanium_enroll","titanium_unenroll","gov_attack_warning"].contains(ctx?.event?.action)' + if: '["account_disabled_password_leak","2sv_disable","2sv_enroll","account_disabled_generic","account_disabled_spamming_through_relay","account_disabled_spamming","account_disabled_hijacked","titanium_enroll","titanium_unenroll","gov_attack_warning","passkey_enrolled","passkey_removed"].contains(ctx?.event?.action)' - append: field: event.category value: configuration @@ -179,10 +179,20 @@ processors: field: event.type value: change if: '["password_edit","recovery_email_edit","recovery_phone_edit","recovery_secret_qa_edit","account_disabled_generic","account_disabled_spamming_through_relay","account_disabled_spamming","account_disabled_hijacked"].contains(ctx?.event?.action)' + - append: + field: event.type + tag: append_creation_into_event_type_for_passkey_enrolled + value: creation + if: '["passkey_enrolled"].contains(ctx?.event?.action)' + - append: + field: event.type + tag: append_deletion_into_event_type_for_passkey_removed + value: deletion + if: '["passkey_removed"].contains(ctx?.event?.action)' - append: field: event.type value: info - if: '["2sv_disable","2sv_enroll","suspicious_login","suspicious_login_less_secure_app","suspicious_programmatic_login","titanium_enroll","titanium_unenroll","blocked_sender","email_forwarding_out_of_domain","login_challenge","login_verification","risky_sensitive_action_allowed","risky_sensitive_action_blocked","account_disabled_password_leak"].contains(ctx?.event?.action)' + if: '["2sv_disable","2sv_enroll","suspicious_login","suspicious_login_less_secure_app","suspicious_programmatic_login","titanium_enroll","titanium_unenroll","blocked_sender","email_forwarding_out_of_domain","login_challenge","login_verification","risky_sensitive_action_allowed","risky_sensitive_action_blocked","account_disabled_password_leak","passkey_enrolled","passkey_removed"].contains(ctx?.event?.action)' - set: field: event.kind value: alert diff --git a/packages/google_workspace/data_stream/login/sample_event.json b/packages/google_workspace/data_stream/login/sample_event.json index a273f6d8d22..fa3f849e2f2 100644 --- a/packages/google_workspace/data_stream/login/sample_event.json +++ b/packages/google_workspace/data_stream/login/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2022-05-04T15:04:05.000Z", "agent": { - "ephemeral_id": "6bfca960-9021-4a33-b298-1b6854b1e312", - "id": "5b3e320e-19d9-4dd3-9df2-ac99d545b1c5", - "name": "elastic-agent-45845", + "ephemeral_id": "8c93a4fd-7826-41c7-93c5-049492fbb595", + "id": "a1cb9595-5cce-49de-b682-888fdfb0238e", + "name": "elastic-agent-11695", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.login", - "namespace": "27499", + "namespace": "40160", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "5b3e320e-19d9-4dd3-9df2-ac99d545b1c5", + "id": "a1cb9595-5cce-49de-b682-888fdfb0238e", "snapshot": false, "version": "8.19.4" }, @@ -26,10 +26,10 @@ "category": [ "iam" ], - "created": "2025-12-08T05:12:21.961Z", + "created": "2026-07-22T07:02:04.442Z", "dataset": "google_workspace.login", "id": "1", - "ingested": "2025-12-08T05:12:24Z", + "ingested": "2026-07-22T07:02:07Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "login", diff --git a/packages/google_workspace/data_stream/meet/_dev/test/pipeline/test-meet.log-expected.json b/packages/google_workspace/data_stream/meet/_dev/test/pipeline/test-meet.log-expected.json index cd71078f2ac..d800f9c3b11 100644 --- a/packages/google_workspace/data_stream/meet/_dev/test/pipeline/test-meet.log-expected.json +++ b/packages/google_workspace/data_stream/meet/_dev/test/pipeline/test-meet.log-expected.json @@ -265,6 +265,9 @@ }, "event": { "action": "invitation-sent", + "category": [ + "network" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-04-11T09:23:00.703Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"invitation_sent\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"meeting_code\", \"value\": \"NTBTYDTXBE\"}, {\"name\": \"conference_id\", \"value\": \"-PeisjX_5iUtKPuGffkJDaBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-04-11T09:23:00.703059Z\"}, {\"name\": \"target_user_count\", \"intValue\": \"1\"}, {\"name\": \"target_phone_number\", \"value\": \"-1\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", @@ -485,6 +488,9 @@ }, "event": { "action": "abuse-report-submitted", + "category": [ + "network" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:37:57.454Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"call\", \"name\": \"abuse_report_submitted\", \"parameters\": [{\"name\": \"meeting_code\", \"value\": \"AIVOTUUFCI\"}, {\"name\": \"conference_id\", \"value\": \"grSyUH5b8bsOXu8Bgz8RDaBcdEfgh\"}, {\"name\": \"organizer_email\", \"value\": \"foo@bar.com\"}, {\"name\": \"calendar_event_id\", \"value\": \"\"}, {\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"endpoint_id\", \"value\": \"boq_hlane_0BRgCp8YDYT\"}, {\"name\": \"device_type\", \"value\": \"web\"}, {\"name\": \"product_type\", \"value\": \"meet\"}, {\"name\": \"display_name\", \"value\": \"Richard Roe\"}, {\"name\": \"ip_address\", \"value\": \"67.43.156.13\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}, {\"name\": \"action_reason\", \"value\": \"spam\"}, {\"name\": \"action_description\", \"value\": \"fole language\"}, {\"name\": \"target_display_names\", \"value\": \"bob, alice\"}]}}", @@ -846,6 +852,9 @@ }, "event": { "action": "presentation-started", + "category": [ + "network" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:29:46.611Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"presentation_started\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"meeting_code\", \"value\": \"KIUPVSZBEZ\"}, {\"name\": \"conference_id\", \"value\": \"ovqzvH9gQJVI2h1IoL_aBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-03-25T10:29:46.611623Z\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", @@ -919,6 +928,9 @@ }, "event": { "action": "presentation-started", + "category": [ + "network" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:29:40.143Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"KEY\", \"key\": \"HANGOUTS_EXTERNAL_OR_ANONYMOUS\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"presentation_started\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": true}, {\"name\": \"meeting_code\", \"value\": \"KIUPVSZBEZ\"}, {\"name\": \"conference_id\", \"value\": \"ovqzvH9gQJVI2h1IoL_aBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-03-25T10:29:40.143797Z\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", @@ -989,6 +1001,9 @@ }, "event": { "action": "presentation-started", + "category": [ + "network" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:29:39.322Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"presentation_started\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"meeting_code\", \"value\": \"KIUPVSZBEZ\"}, {\"name\": \"conference_id\", \"value\": \"ovqzvH9gQJVI2h1IoL_aBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-03-25T10:29:39.322717Z\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", @@ -1062,6 +1077,9 @@ }, "event": { "action": "invitation-sent", + "category": [ + "network" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:28:07.109Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"invitation_sent\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"meeting_code\", \"value\": \"KIUPVSZBEZ\"}, {\"name\": \"conference_id\", \"value\": \"ovqzvH9gQJVI2h1IoL_aBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-03-25T10:28:07.109881Z\"}, {\"name\": \"target_user_count\", \"intValue\": \"1\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", diff --git a/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml index 33cc2547df2..fff2f8cd33a 100644 --- a/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml @@ -95,9 +95,9 @@ processors: value: event - append: field: event.category - tag: set_network_into_event_category + tag: append_network_into_event_category value: network - if: ctx.google_workspace?.meet?.name != null && ctx.google_workspace.meet.name == "call_ended" + if: ctx.google_workspace?.meet?.name != null - script: description: Set event type based on event name. if: ctx.google_workspace?.meet?.name != null @@ -107,22 +107,38 @@ processors: abuse_report_submitted: info broadcast_activity: info call_ended: info - livestream_watched: info + closed_captions_started: info + consented_to_third_party_media_app: info dialed_out: info + hand_raised: info in_meet_broadcast_activity: info invitation_sent: info knocking_accepted: info knocking_denied: info + livestream_watched: info poll_answered: info poll_created: creation presentation_started: info presentation_stopped: info question_created: creation question_responded: info + reaction_sent: info recording_activity: info ring_answered: info ring_missed: info ring_sent: info + room_check_in: info + room_check_out: info + see_chat_everyone: info + see_chat_participants: info + send_chat_contributors: info + send_chat_everyone: info + send_chat_hosts: info + smart_notes_session_started: info + smart_notes_session_stopped: info + speech_translation_allowed: info + speech_translation_disallowed: info + streaming_session_explicit_consent: info transcription_activity: info watermarking_active: info watermarking_starting: info diff --git a/packages/google_workspace/data_stream/meet/sample_event.json b/packages/google_workspace/data_stream/meet/sample_event.json index 5e9bf23ce76..99ab73cd3c2 100644 --- a/packages/google_workspace/data_stream/meet/sample_event.json +++ b/packages/google_workspace/data_stream/meet/sample_event.json @@ -1,31 +1,34 @@ { "@timestamp": "2025-04-11T09:23:00.703059Z", "agent": { - "ephemeral_id": "7a575721-1942-4427-82ec-22448e27a2d1", - "id": "eb41b16b-f309-4682-9d3a-30342d680fe9", - "name": "elastic-agent-32126", + "ephemeral_id": "71d11372-1a72-49b3-a1a6-37b19a3f7851", + "id": "722fe293-8487-43c7-bb6e-df12f5f19e44", + "name": "elastic-agent-18911", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.meet", - "namespace": "56950", + "namespace": "47636", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "eb41b16b-f309-4682-9d3a-30342d680fe9", - "snapshot": true, - "version": "8.18.0" + "id": "722fe293-8487-43c7-bb6e-df12f5f19e44", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "invitation-sent", "agent_id_status": "verified", + "category": [ + "network" + ], "dataset": "google_workspace.meet", "id": "1", - "ingested": "2025-05-05T10:30:54Z", + "ingested": "2026-07-22T07:03:23Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"invitation_sent\",\"parameters\":[{\"boolValue\":false,\"name\":\"is_external\"},{\"name\":\"meeting_code\",\"value\":\"NTBTYDTXBE\"},{\"name\":\"conference_id\",\"value\":\"-PeisjX_5iUtKPuGffkJDaBcdEfgh\"},{\"name\":\"action_time\",\"value\":\"2025-04-11T09:23:00.703059Z\"},{\"intValue\":\"1\",\"name\":\"target_user_count\"},{\"name\":\"identifier\",\"value\":\"foo@bar.com\"},{\"name\":\"identifier_type\",\"value\":\"email_address\"}],\"type\":\"conference_action\"},\"id\":{\"applicationName\":\"meet\",\"customerId\":\"1\",\"time\":\"2025-04-11T09:23:00.703Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "meet", diff --git a/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json b/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json index 48166a0954c..dcf10883308 100644 --- a/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json +++ b/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json @@ -7,10 +7,16 @@ }, "event": { "action": "rule_match", + "category": [ + "intrusion_detection" + ], "id": "1", - "kind": "event", + "kind": "alert", "original": "{\"kind\":\"admin#reports#activity\",\"etag\":\"Etag\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"rules\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"example.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"rule_match_type\",\"name\":\"rule_match\",\"parameters\":[{\"name\":\"has_alert\",\"boolValue\":\"true\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"name\":\"resource_recipients_omitted_count\",\"intValue\":\"1234\"},{\"name\":\"resource_recipients\",\"multiValue\":[\"bar@bar.com\",\"foo@example.com\",\"foo@foo.com\"]},{\"name\":\"rule_name\",\"multiValue\":[\"managers\"]},{\"name\":\"rule_id\",\"multiIntValue\":[\"12\"]}]}}", - "provider": "rules" + "provider": "rules", + "type": [ + "info" + ] }, "google_workspace": { "actor": { @@ -121,10 +127,16 @@ }, "event": { "action": "rule_match", + "category": [ + "intrusion_detection" + ], "id": "1", - "kind": "event", + "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-11-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", - "provider": "rules" + "provider": "rules", + "type": [ + "info" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml index 1270097429b..b5a370ec7f2 100644 --- a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml @@ -206,9 +206,6 @@ processors: if: ctx.source?.user?.name != null allow_duplicates: false ignore_failure: true - - set: - field: event.kind - value: event - script: lang: painless description: Map Event parameters into key value pair. @@ -503,6 +500,40 @@ processors: if: ctx.google_workspace?.rules?.actor_ip_address != null allow_duplicates: false ignore_failure: true + - set: + field: event.kind + tag: set_event_kind + value: event + - append: + field: event.category + tag: append_intrusion_detection_into_event_category_for_rule_events + value: intrusion_detection + if: ctx.event?.action != null && ["rule_match","rule_trigger","action_complete"].contains(ctx.event.action) + - append: + field: event.category + tag: append_configuration_into_event_category_for_label_events + value: configuration + if: ctx.event?.action != null && ["label_applied","label_field_value_changed","label_removed"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type_for_rule_events + value: info + if: ctx.event?.action != null && ["rule_match","rule_trigger","action_complete"].contains(ctx.event.action) + - append: + field: event.type + tag: append_change_into_event_type_for_label_events + value: change + if: ctx.event?.action != null && ["label_applied","label_field_value_changed"].contains(ctx.event.action) + - append: + field: event.type + tag: append_deletion_into_event_type_for_label_removed + value: deletion + if: ctx.event?.action != null && ["label_removed"].contains(ctx.event.action) + - set: + field: event.kind + tag: set_event_kind_to_alert + value: alert + if: ctx.google_workspace?.rules?.has_alert == true - remove: field: - json diff --git a/packages/google_workspace/data_stream/rules/sample_event.json b/packages/google_workspace/data_stream/rules/sample_event.json index fe2b2ddca8a..49214df1a8e 100644 --- a/packages/google_workspace/data_stream/rules/sample_event.json +++ b/packages/google_workspace/data_stream/rules/sample_event.json @@ -1,35 +1,41 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "afeffc94-1ad8-47d1-8fcf-40e838558833", - "id": "aace98bd-8a95-4d13-a919-0a9d6f7f8093", - "name": "elastic-agent-65365", + "ephemeral_id": "776f9fab-6ea9-4ded-8c41-ad7eb70e1555", + "id": "ac62844a-a037-494e-aac7-b1b25ce7063c", + "name": "elastic-agent-45067", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.rules", - "namespace": "63851", + "namespace": "20633", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "aace98bd-8a95-4d13-a919-0a9d6f7f8093", + "id": "ac62844a-a037-494e-aac7-b1b25ce7063c", "snapshot": false, "version": "8.19.4" }, "event": { "action": "rule_match", "agent_id_status": "verified", - "created": "2025-12-08T05:13:21.070Z", + "category": [ + "intrusion_detection" + ], + "created": "2026-07-22T07:04:40.667Z", "dataset": "google_workspace.rules", "id": "1", - "ingested": "2025-12-08T05:13:24Z", - "kind": "event", + "ingested": "2026-07-22T07:04:43Z", + "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", - "provider": "rules" + "provider": "rules", + "type": [ + "info" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/vault/_dev/test/pipeline/test-vault.log-expected.json b/packages/google_workspace/data_stream/vault/_dev/test/pipeline/test-vault.log-expected.json index 38f56dcd0b8..7b9796409fe 100644 --- a/packages/google_workspace/data_stream/vault/_dev/test/pipeline/test-vault.log-expected.json +++ b/packages/google_workspace/data_stream/vault/_dev/test/pipeline/test-vault.log-expected.json @@ -7,6 +7,9 @@ }, "event": { "action": "export", + "category": [ + "file" + ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-04-10T19:06:06.187Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"vault\", \"customerId\": \"1\"}, \"etag\": \"XB4Sd9ZEYpFd-msikcPTLY7Ao7PvyP0QeR9k5OdWZ_Y/9-plyixf2zhrQhgHCQ7-_gbusr4\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"export\", \"parameters\": [{\"name\": \"matter_id\", \"value\": \"123456789-73d5-4b01-ae1a-abcdefgh\"}, {\"name\": \"additional_details\", \"value\": \"export_name: \\\"Export\\\"\\nquery: \\\"( from:google.com )\\\"\\ntype: \\\"EMAIL\\\"\\nexport_format: MBOX\\ndata_region: \\\"United States\\\"\\nshow_locker_content: true\\nuse_improved_export: true\\nexport_linked_drive_files: true\\n\"}, {\"name\": \"query\", \"value\": \"mode: All data, type: Mail, terms: from:google.com, Time zone: America/Los_Angeles, \"}]}}", diff --git a/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml index 1a91d9035c9..6d44890c35e 100644 --- a/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml @@ -176,6 +176,13 @@ processors: view_retention_policy: configuration view_retention_settings: configuration view_system_audit_log: configuration + download_count_per_account_csv: file + export: file + export_file_download: file + legacy_export_download: file + view_document: file + view_document_information: file + view_external_document: file source: |- ctx.event = ctx.event ?: [:]; def category = []; diff --git a/packages/google_workspace/data_stream/vault/sample_event.json b/packages/google_workspace/data_stream/vault/sample_event.json index 396fe75624f..53825b82a36 100644 --- a/packages/google_workspace/data_stream/vault/sample_event.json +++ b/packages/google_workspace/data_stream/vault/sample_event.json @@ -1,24 +1,24 @@ { "@timestamp": "2025-04-10T19:05:24.881Z", "agent": { - "ephemeral_id": "540f8dff-4158-4152-a7b6-757f8019ae43", - "id": "e5b82ff4-853f-4f9f-9a68-54de01dc5631", - "name": "elastic-agent-58720", + "ephemeral_id": "f655fbf2-623b-4948-a638-c1ccd743a3ef", + "id": "1be3bd34-3d99-4e8a-bcda-4ee31f491bd4", + "name": "elastic-agent-79178", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.vault", - "namespace": "52776", + "namespace": "64267", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "e5b82ff4-853f-4f9f-9a68-54de01dc5631", - "snapshot": true, - "version": "8.18.0" + "id": "1be3bd34-3d99-4e8a-bcda-4ee31f491bd4", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "view-per-matter-litigation-hold-report", @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.vault", "id": "1", - "ingested": "2025-04-23T06:26:01Z", + "ingested": "2026-07-22T07:05:48Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"XB4Sd9ZEYpFd-msikcPTLY7Ao7PvyP0QeR9k5OdWZ_Y/77VsZvNcux1EnUIu_SyN08-cHo8\",\"events\":{\"name\":\"view_per_matter_litigation_hold_report\",\"parameters\":[{\"name\":\"matter_id\",\"value\":\"78504485-73d5-4b01-ae1a-63ebc1ae66eb\"},{\"name\":\"resource_name\",\"value\":\"0\"},{\"name\":\"additional_details\",\"value\":\"matter_name: \\\"Demo\\\"\\n\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"vault\",\"customerId\":\"1\",\"time\":\"2025-04-10T19:05:24.881Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "vault", diff --git a/packages/google_workspace/docs/README.md b/packages/google_workspace/docs/README.md index ff77464cf7d..d75d4106a5e 100644 --- a/packages/google_workspace/docs/README.md +++ b/packages/google_workspace/docs/README.md @@ -524,22 +524,22 @@ An example event for `login` looks as following: { "@timestamp": "2022-05-04T15:04:05.000Z", "agent": { - "ephemeral_id": "6bfca960-9021-4a33-b298-1b6854b1e312", - "id": "5b3e320e-19d9-4dd3-9df2-ac99d545b1c5", - "name": "elastic-agent-45845", + "ephemeral_id": "8c93a4fd-7826-41c7-93c5-049492fbb595", + "id": "a1cb9595-5cce-49de-b682-888fdfb0238e", + "name": "elastic-agent-11695", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.login", - "namespace": "27499", + "namespace": "40160", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "5b3e320e-19d9-4dd3-9df2-ac99d545b1c5", + "id": "a1cb9595-5cce-49de-b682-888fdfb0238e", "snapshot": false, "version": "8.19.4" }, @@ -549,10 +549,10 @@ An example event for `login` looks as following: "category": [ "iam" ], - "created": "2025-12-08T05:12:21.961Z", + "created": "2026-07-22T07:02:04.442Z", "dataset": "google_workspace.login", "id": "1", - "ingested": "2025-12-08T05:12:24Z", + "ingested": "2026-07-22T07:02:07Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "login", @@ -666,35 +666,41 @@ An example event for `rules` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "afeffc94-1ad8-47d1-8fcf-40e838558833", - "id": "aace98bd-8a95-4d13-a919-0a9d6f7f8093", - "name": "elastic-agent-65365", + "ephemeral_id": "776f9fab-6ea9-4ded-8c41-ad7eb70e1555", + "id": "ac62844a-a037-494e-aac7-b1b25ce7063c", + "name": "elastic-agent-45067", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.rules", - "namespace": "63851", + "namespace": "20633", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "aace98bd-8a95-4d13-a919-0a9d6f7f8093", + "id": "ac62844a-a037-494e-aac7-b1b25ce7063c", "snapshot": false, "version": "8.19.4" }, "event": { "action": "rule_match", "agent_id_status": "verified", - "created": "2025-12-08T05:13:21.070Z", + "category": [ + "intrusion_detection" + ], + "created": "2026-07-22T07:04:40.667Z", "dataset": "google_workspace.rules", "id": "1", - "ingested": "2025-12-08T05:13:24Z", - "kind": "event", + "ingested": "2026-07-22T07:04:43Z", + "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", - "provider": "rules" + "provider": "rules", + "type": [ + "info" + ] }, "google_workspace": { "actor": { @@ -1765,37 +1771,44 @@ An example event for `device` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "bd04308b-2f70-430a-883a-4e7cd10123d7", - "id": "10c458fc-acd6-4cca-8d04-2263ff81c7e6", - "name": "elastic-agent-75163", + "ephemeral_id": "fa7c7a33-e988-49e4-81ec-a86495301da8", + "id": "0092765f-1d94-4789-973f-de5714762cd5", + "name": "elastic-agent-50116", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.device", - "namespace": "34729", + "namespace": "12815", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "10c458fc-acd6-4cca-8d04-2263ff81c7e6", + "id": "0092765f-1d94-4789-973f-de5714762cd5", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2025-12-08T04:34:13.648Z", + "category": [ + "host", + "package" + ], + "created": "2026-07-22T06:57:43.273Z", "dataset": "google_workspace.device", "id": "1", - "ingested": "2025-12-08T04:34:16Z", - "kind": [ - "event" - ], + "ingested": "2026-07-22T06:57:46Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "outcome": "failure", + "provider": "device", + "type": [ + "change", + "installation" + ] }, "google_workspace": { "actor": { @@ -2036,37 +2049,43 @@ An example event for `group_enterprise` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "1e96a41d-fab8-4711-b3b7-2c80d7684821", - "id": "a4ef7a22-cfd6-4e87-aaa9-ea58e64ca9b3", - "name": "elastic-agent-82451", + "ephemeral_id": "6a987c97-d057-4150-91e1-a2bd50c5e6da", + "id": "18b072b8-ac88-483c-a90d-49c240a62c32", + "name": "elastic-agent-95571", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.group_enterprise", - "namespace": "18098", + "namespace": "54811", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "a4ef7a22-cfd6-4e87-aaa9-ea58e64ca9b3", + "id": "18b072b8-ac88-483c-a90d-49c240a62c32", "snapshot": false, "version": "8.19.4" }, "event": { "action": "add_info_setting", "agent_id_status": "verified", - "created": "2025-12-08T04:39:03.176Z", + "category": [ + "iam", + "configuration" + ], + "created": "2026-07-22T06:59:56.725Z", "dataset": "google_workspace.group_enterprise", "id": "1", - "ingested": "2025-12-08T04:39:06Z", - "kind": [ - "event" - ], + "ingested": "2026-07-22T06:59:59Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}],\"type\":\"moderator_action\"},\"id\":{\"applicationName\":\"group_enterprise\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "group_enterprise" + "provider": "group_enterprise", + "type": [ + "group", + "creation" + ] }, "google_workspace": { "actor": { @@ -2625,35 +2644,33 @@ An example event for `context_aware_access` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "98e152de-6cca-41b4-a96c-7d524ad1d520", - "id": "e28183dc-9502-4bc0-b6f9-057d8093d53f", - "name": "elastic-agent-23811", + "ephemeral_id": "3a36557f-f0d1-4a59-8361-19a8609a8d7a", + "id": "65ce985f-497e-456d-b6d8-e0c0f3864a08", + "name": "elastic-agent-64228", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.context_aware_access", - "namespace": "31084", + "namespace": "65428", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "e28183dc-9502-4bc0-b6f9-057d8093d53f", + "id": "65ce985f-497e-456d-b6d8-e0c0f3864a08", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2025-12-08T04:33:03.762Z", + "created": "2026-07-22T06:56:35.154Z", "dataset": "google_workspace.context_aware_access", "id": "1", - "ingested": "2025-12-08T04:33:06Z", - "kind": [ - "event" - ], + "ingested": "2026-07-22T06:56:38Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "provider": "device" }, @@ -2795,37 +2812,41 @@ An example event for `gcp` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "0505a3b2-62e8-4aef-a980-f0528788398b", - "id": "ee5f48ab-58d5-424d-97af-ce9077453cee", - "name": "elastic-agent-76346", + "ephemeral_id": "e462c95e-fc7b-4e8c-8e17-c078bbd6363a", + "id": "3be6ee34-e840-4202-a088-f8cbacd473b4", + "name": "elastic-agent-95567", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.gcp", - "namespace": "72783", + "namespace": "98644", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "ee5f48ab-58d5-424d-97af-ce9077453cee", + "id": "3be6ee34-e840-4202-a088-f8cbacd473b4", "snapshot": false, "version": "8.19.4" }, "event": { "action": "IMPORT_SSH_PUBLIC_KEY", "agent_id_status": "verified", - "created": "2025-12-08T04:36:32.150Z", + "category": [ + "iam" + ], + "created": "2026-07-22T06:59:03.390Z", "dataset": "google_workspace.gcp", "id": "1", - "ingested": "2025-12-08T04:36:35Z", - "kind": [ - "event" - ], + "ingested": "2026-07-22T06:59:06Z", + "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"foo@bar.com\"}],\"type\":\"CLOUD_OSLOGIN\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "provider": "device", + "type": [ + "creation" + ] }, "google_workspace": { "actor": { @@ -2951,15 +2972,15 @@ An example event for `chrome` looks as following: { "@timestamp": "2024-12-09T14:18:25.405Z", "agent": { - "ephemeral_id": "5e3c65b6-9b4b-4f04-adaa-cc64f98c8310", - "id": "529394dd-d27c-464d-9215-01b83c09d076", - "name": "elastic-agent-85230", + "ephemeral_id": "2b7f7f2f-6c69-4d6b-8edd-948ca3c6f110", + "id": "21d74789-d99d-4dfe-af4a-2288b3a564de", + "name": "elastic-agent-48415", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chrome", - "namespace": "32993", + "namespace": "80177", "type": "logs" }, "device": { @@ -2971,21 +2992,27 @@ An example event for `chrome` looks as following: "version": "8.16.0" }, "elastic_agent": { - "id": "529394dd-d27c-464d-9215-01b83c09d076", + "id": "21d74789-d99d-4dfe-af4a-2288b3a564de", "snapshot": false, "version": "8.19.4" }, "event": { "action": "browser_extension_install", "agent_id_status": "verified", + "category": [ + "package" + ], "dataset": "google_workspace.chrome", "id": "-3640711002716937498", - "ingested": "2026-01-21T12:47:55Z", + "ingested": "2026-07-22T06:55:21Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh.kumar@example.io\",\"profileId\":\"109689693170624712102\"},\"etag\":\"\\\"CfV-pEPVZc7PJf2fWsHJTliD34MdGbO8iFIk3L4uBwQ/cBsNSJx2A9Lg8kiQCGLddmq827A\\\"\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"lmjegmlicamnimmfhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"02gajno12larrqx\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", "provider": "chrome", - "reason": "BROWSER_EXTENSION_INSTALL" + "reason": "BROWSER_EXTENSION_INSTALL", + "type": [ + "installation" + ] }, "google_workspace": { "chrome": { @@ -3043,7 +3070,8 @@ An example event for `chrome` looks as following: "related": { "user": [ "kalpesh.kumar@example.io", - "109689693170624712102" + "109689693170624712102", + "kalpesh.kumar" ] }, "source": { @@ -3334,24 +3362,24 @@ An example event for `calendar` looks as following: { "@timestamp": "2025-04-01T07:00:40.262Z", "agent": { - "ephemeral_id": "c496161a-177e-4359-8324-e11405aeeaad", - "id": "1ab21f00-c503-4805-b1de-01dacd186aef", - "name": "elastic-agent-44155", + "ephemeral_id": "bff7fec7-4d40-45ad-be16-632427fab559", + "id": "b3774315-d26c-4bf5-9778-d470566fab35", + "name": "elastic-agent-85176", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.calendar", - "namespace": "50432", + "namespace": "40687", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "1ab21f00-c503-4805-b1de-01dacd186aef", - "snapshot": true, - "version": "8.18.0" + "id": "b3774315-d26c-4bf5-9778-d470566fab35", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "delete-calendar", @@ -3361,7 +3389,7 @@ An example event for `calendar` looks as following: ], "dataset": "google_workspace.calendar", "id": "1", - "ingested": "2025-04-22T12:01:05Z", + "ingested": "2026-07-22T07:07:30Z", "kind": "event", "original": "{\"actor\":{\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"delete_calendar\",\"parameters\":[{\"name\":\"calendar_id\",\"value\":\"c_abc123@group.calendar.google.com\"},{\"name\":\"api_kind\",\"value\":\"web\"},{\"name\":\"user_agent\",\"value\":\"Mozilla/5.0\"}],\"type\":\"calendar_change\"},\"id\":{\"applicationName\":\"calendar\",\"customerId\":\"1\",\"time\":\"2025-04-01T07:00:40.262Z\",\"uniqueQualifier\":\"1\"},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "calendar", @@ -3511,24 +3539,24 @@ An example event for `chat` looks as following: { "@timestamp": "2025-03-26T05:55:02.063Z", "agent": { - "ephemeral_id": "afc7ce98-0520-45e0-94c4-64274b308642", - "id": "411b5487-ebfa-4a91-89da-d7e59f3f1cd2", - "name": "elastic-agent-11706", + "ephemeral_id": "6449a9b1-d610-4094-960a-4e43c2c87006", + "id": "13ad2886-85c9-43e5-8293-9bd32dbf1657", + "name": "elastic-agent-40045", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chat", - "namespace": "37789", + "namespace": "80821", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "411b5487-ebfa-4a91-89da-d7e59f3f1cd2", - "snapshot": true, - "version": "8.18.0" + "id": "13ad2886-85c9-43e5-8293-9bd32dbf1657", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "room-name-updated", @@ -3538,7 +3566,7 @@ An example event for `chat` looks as following: ], "dataset": "google_workspace.chat", "id": "1", - "ingested": "2025-04-16T08:53:19Z", + "ingested": "2026-07-22T06:53:39Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\",\"events\":{\"name\":\"room_name_updated\",\"parameters\":[{\"name\":\"room_id\",\"value\":\"1\"},{\"name\":\"actor\",\"value\":\"foo@bar.com\"},{\"name\":\"room_name\",\"value\":\"TEST3\"},{\"name\":\"external_room\",\"value\":\"DISABLED\"},{\"name\":\"actor_type\",\"value\":\"NON_ADMIN\"},{\"name\":\"conversation_type\",\"value\":\"SPACE\"},{\"name\":\"conversation_ownership\",\"value\":\"INTERNALLY_OWNED\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"chat\",\"customerId\":\"1\",\"time\":\"2025-03-26T05:55:02.063Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "chat", @@ -3660,24 +3688,24 @@ An example event for `vault` looks as following: { "@timestamp": "2025-04-10T19:05:24.881Z", "agent": { - "ephemeral_id": "540f8dff-4158-4152-a7b6-757f8019ae43", - "id": "e5b82ff4-853f-4f9f-9a68-54de01dc5631", - "name": "elastic-agent-58720", + "ephemeral_id": "f655fbf2-623b-4948-a638-c1ccd743a3ef", + "id": "1be3bd34-3d99-4e8a-bcda-4ee31f491bd4", + "name": "elastic-agent-79178", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.vault", - "namespace": "52776", + "namespace": "64267", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "e5b82ff4-853f-4f9f-9a68-54de01dc5631", - "snapshot": true, - "version": "8.18.0" + "id": "1be3bd34-3d99-4e8a-bcda-4ee31f491bd4", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "view-per-matter-litigation-hold-report", @@ -3687,7 +3715,7 @@ An example event for `vault` looks as following: ], "dataset": "google_workspace.vault", "id": "1", - "ingested": "2025-04-23T06:26:01Z", + "ingested": "2026-07-22T07:05:48Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"XB4Sd9ZEYpFd-msikcPTLY7Ao7PvyP0QeR9k5OdWZ_Y/77VsZvNcux1EnUIu_SyN08-cHo8\",\"events\":{\"name\":\"view_per_matter_litigation_hold_report\",\"parameters\":[{\"name\":\"matter_id\",\"value\":\"78504485-73d5-4b01-ae1a-63ebc1ae66eb\"},{\"name\":\"resource_name\",\"value\":\"0\"},{\"name\":\"additional_details\",\"value\":\"matter_name: \\\"Demo\\\"\\n\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"vault\",\"customerId\":\"1\",\"time\":\"2025-04-10T19:05:24.881Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "vault", @@ -3809,31 +3837,34 @@ An example event for `meet` looks as following: { "@timestamp": "2025-04-11T09:23:00.703059Z", "agent": { - "ephemeral_id": "7a575721-1942-4427-82ec-22448e27a2d1", - "id": "eb41b16b-f309-4682-9d3a-30342d680fe9", - "name": "elastic-agent-32126", + "ephemeral_id": "71d11372-1a72-49b3-a1a6-37b19a3f7851", + "id": "722fe293-8487-43c7-bb6e-df12f5f19e44", + "name": "elastic-agent-18911", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.meet", - "namespace": "56950", + "namespace": "47636", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "eb41b16b-f309-4682-9d3a-30342d680fe9", - "snapshot": true, - "version": "8.18.0" + "id": "722fe293-8487-43c7-bb6e-df12f5f19e44", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "invitation-sent", "agent_id_status": "verified", + "category": [ + "network" + ], "dataset": "google_workspace.meet", "id": "1", - "ingested": "2025-05-05T10:30:54Z", + "ingested": "2026-07-22T07:03:23Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"invitation_sent\",\"parameters\":[{\"boolValue\":false,\"name\":\"is_external\"},{\"name\":\"meeting_code\",\"value\":\"NTBTYDTXBE\"},{\"name\":\"conference_id\",\"value\":\"-PeisjX_5iUtKPuGffkJDaBcdEfgh\"},{\"name\":\"action_time\",\"value\":\"2025-04-11T09:23:00.703059Z\"},{\"intValue\":\"1\",\"name\":\"target_user_count\"},{\"name\":\"identifier\",\"value\":\"foo@bar.com\"},{\"name\":\"identifier_type\",\"value\":\"email_address\"}],\"type\":\"conference_action\"},\"id\":{\"applicationName\":\"meet\",\"customerId\":\"1\",\"time\":\"2025-04-11T09:23:00.703Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "meet", @@ -4009,31 +4040,34 @@ An example event for `keep` looks as following: { "@timestamp": "2025-03-27T12:45:08.310Z", "agent": { - "ephemeral_id": "e43a76f4-47c9-40b4-b16e-547081b85cca", - "id": "d2812dfd-bd3b-46f8-b372-9357a26b4580", - "name": "elastic-agent-49635", + "ephemeral_id": "a1dc4da9-10b6-4671-b3d9-20f0c9558c3f", + "id": "a1731c07-db09-45af-aa19-cd51604e7136", + "name": "elastic-agent-87212", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.keep", - "namespace": "61415", + "namespace": "60175", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "d2812dfd-bd3b-46f8-b372-9357a26b4580", - "snapshot": true, - "version": "8.18.0" + "id": "a1731c07-db09-45af-aa19-cd51604e7136", + "snapshot": false, + "version": "8.19.4" }, "event": { "action": "uploaded-attachment", "agent_id_status": "verified", + "category": [ + "file" + ], "dataset": "google_workspace.keep", "id": "0", - "ingested": "2025-04-29T06:58:21Z", + "ingested": "2026-07-22T07:00:49Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\",\"events\":{\"name\":\"uploaded_attachment\",\"parameters\":[{\"name\":\"owner_email\",\"value\":\"foo@bar.com\"},{\"name\":\"note_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz\"},{\"name\":\"attachment_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"keep\",\"customerId\":\"1\",\"time\":\"2025-03-27T12:45:08.310Z\",\"uniqueQualifier\":\"0\"},\"kind\":\"admin#reports#activity\"}", "provider": "keep", diff --git a/packages/google_workspace/manifest.yml b/packages/google_workspace/manifest.yml index bbd62a836fb..406b8138e35 100644 --- a/packages/google_workspace/manifest.yml +++ b/packages/google_workspace/manifest.yml @@ -1,6 +1,6 @@ name: google_workspace title: Google Workspace -version: "3.5.0" +version: "3.5.1" source: license: Elastic-2.0 description: Collect logs from Google Workspace with Elastic Agent. From 9ea3c67c1793a0d80ec0ce9d551cb1dd7e0fe279 Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Wed, 22 Jul 2026 13:47:38 +0530 Subject: [PATCH 3/9] update changelog entries --- packages/azure/changelog.yml | 2 +- packages/google_workspace/changelog.yml | 2 +- packages/jamf_pro/changelog.yml | 2 +- packages/sublime_security/changelog.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/azure/changelog.yml b/packages/azure/changelog.yml index 22541088c7c..a5a684045da 100644 --- a/packages/azure/changelog.yml +++ b/packages/azure/changelog.yml @@ -2,7 +2,7 @@ changes: - description: Add ECS event categorization fields to the graphactivitylogs data stream. type: bugfix - link: https://github.com/elastic/integrations/issues/1 + link: https://github.com/elastic/integrations/pull/20276 - version: "1.37.0" changes: - description: Add azure.aadgraphactivitylogs dataset to ingest legacy Azure AD Graph (graph.windows.net) AzureADGraphActivityLogs diagnostic events. diff --git a/packages/google_workspace/changelog.yml b/packages/google_workspace/changelog.yml index 26949b1506a..4fbce891123 100644 --- a/packages/google_workspace/changelog.yml +++ b/packages/google_workspace/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Add missing ECS event categorization for the gcp, rules, calendar, group_enterprise, context_aware_access, meet, chat, chrome, login, device, keep, and vault data streams. type: bugfix - link: https://github.com/elastic/integrations/issues/1 + link: https://github.com/elastic/integrations/pull/20276 - version: "3.5.0" changes: - description: Reduce default lag times for login, gcp, user_accounts, groups, group_enterprise, and calendar data streams to align with Google documented reporting delays. diff --git a/packages/jamf_pro/changelog.yml b/packages/jamf_pro/changelog.yml index 9faf486ca6f..84009717de9 100644 --- a/packages/jamf_pro/changelog.yml +++ b/packages/jamf_pro/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Add ECS event categorization fields to the events data stream. type: bugfix - link: https://github.com/elastic/integrations/issues/1 + link: https://github.com/elastic/integrations/pull/20276 - version: "1.3.0" changes: - description: Enable Agentless deployment. diff --git a/packages/sublime_security/changelog.yml b/packages/sublime_security/changelog.yml index 9ec3f6ce779..81784e61d0b 100644 --- a/packages/sublime_security/changelog.yml +++ b/packages/sublime_security/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Add ECS event categorization fields to the audit data stream. type: bugfix - link: https://github.com/elastic/integrations/issues/1 + link: https://github.com/elastic/integrations/pull/20276 - version: "1.12.1" changes: - description: Use the ECS definition for email.attachments. From 6c76d69a2af83ae066cd6c8d511cf9248d2386c0 Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Wed, 22 Jul 2026 15:41:47 +0530 Subject: [PATCH 4/9] add missing event categorization in github.issues data stream --- packages/github/changelog.yml | 5 +++++ .../test-github-issues-json.log-expected.json | 20 +++++++++++++++++++ .../elasticsearch/ingest_pipeline/default.yml | 19 ++++++++++++++++++ .../data_stream/issues/sample_event.json | 16 +++++++++------ packages/github/docs/README.md | 16 +++++++++------ packages/github/manifest.yml | 2 +- .../elasticsearch/ingest_pipeline/default.yml | 2 +- 7 files changed, 66 insertions(+), 14 deletions(-) diff --git a/packages/github/changelog.yml b/packages/github/changelog.yml index 2246432b0a4..d8f4ec4dd83 100644 --- a/packages/github/changelog.yml +++ b/packages/github/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "2.25.1" + changes: + - description: Add ECS event categorization fields to the `issues` data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/20276 - version: "2.25.0" changes: - description: Use new `release` field for agentless deployment mode to establish as beta. diff --git a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json index 419b14cec9b..0f6c826f1b6 100644 --- a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json +++ b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json @@ -6,6 +6,10 @@ "version": "8.11.0" }, "event": { + "action": "opened", + "category": [ + "configuration" + ], "created": "2011-04-22T13:33:48.000Z", "kind": "event", "original": "{\"id\":1,\"node_id\":\"MDU6SXNzdWUx\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"number\":1347,\"state\":\"open\",\"title\":\"Found a bug\",\"body\":\"I'm having a problem with this.\",\"user\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":true},\"labels\":[{\"id\":208045946,\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\",\"name\":\"bug\",\"description\":\"Something isn't working\",\"color\":\"f29513\",\"default\":true}],\"assignee\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"assignees\":[{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false}],\"milestone\":{\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"id\":1002604,\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"state\":\"open\",\"title\":\"v1.0\",\"description\":\"Tracking milestone for version 1.0\",\"creator\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"open_issues\":4,\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"closed_at\":\"2013-02-12T13:22:01Z\",\"due_on\":\"2012-10-09T23:39:01Z\"},\"locked\":true,\"active_lock_reason\":\"too heated\",\"comments\":0,\"pull_request\":{\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\"},\"closed_at\":null,\"created_at\":\"2011-04-22T13:33:48Z\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"closed_by\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"repository\": {\"id\":1296269,\"node_id\":\"MDEwOlJlcG9zaXRvcnkxMjk2MjY5\",\"name\":\"Hello-World\",\"full_name\":\"octocat/Hello-World\",\"owner\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"private\":false,\"html_url\":\"https://github.com/octocat/Hello-World\",\"description\":\"This your first repo!\",\"fork\":false,\"url\":\"https://api.github.com/repos/octocat/Hello-World\",\"archive_url\":\"https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}\",\"assignees_url\":\"https://api.github.com/repos/octocat/Hello-World/assignees{/user}\",\"blobs_url\":\"https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}\",\"branches_url\":\"https://api.github.com/repos/octocat/Hello-World/branches{/branch}\",\"collaborators_url\":\"https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}\",\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/comments{/number}\",\"commits_url\":\"https://api.github.com/repos/octocat/Hello-World/commits{/sha}\",\"compare_url\":\"https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}\",\"contents_url\":\"https://api.github.com/repos/octocat/Hello-World/contents/{+path}\",\"contributors_url\":\"https://api.github.com/repos/octocat/Hello-World/contributors\",\"deployments_url\":\"https://api.github.com/repos/octocat/Hello-World/deployments\",\"downloads_url\":\"https://api.github.com/repos/octocat/Hello-World/downloads\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/events\",\"forks_url\":\"https://api.github.com/repos/octocat/Hello-World/forks\",\"git_commits_url\":\"https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}\",\"git_refs_url\":\"https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}\",\"git_tags_url\":\"https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}\",\"git_url\":\"git:github.com/octocat/Hello-World.git\",\"issue_comment_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}\",\"issue_events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/events{/number}\",\"issues_url\":\"https://api.github.com/repos/octocat/Hello-World/issues{/number}\",\"keys_url\":\"https://api.github.com/repos/octocat/Hello-World/keys{/key_id}\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/labels{/name}\",\"languages_url\":\"https://api.github.com/repos/octocat/Hello-World/languages\",\"merges_url\":\"https://api.github.com/repos/octocat/Hello-World/merges\",\"milestones_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones{/number}\",\"notifications_url\":\"https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}\",\"pulls_url\":\"https://api.github.com/repos/octocat/Hello-World/pulls{/number}\",\"releases_url\":\"https://api.github.com/repos/octocat/Hello-World/releases{/id}\",\"ssh_url\":\"git@github.com:octocat/Hello-World.git\",\"stargazers_url\":\"https://api.github.com/repos/octocat/Hello-World/stargazers\",\"statuses_url\":\"https://api.github.com/repos/octocat/Hello-World/statuses/{sha}\",\"subscribers_url\":\"https://api.github.com/repos/octocat/Hello-World/subscribers\",\"subscription_url\":\"https://api.github.com/repos/octocat/Hello-World/subscription\",\"tags_url\":\"https://api.github.com/repos/octocat/Hello-World/tags\",\"teams_url\":\"https://api.github.com/repos/octocat/Hello-World/teams\",\"trees_url\":\"https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}\",\"clone_url\":\"https://github.com/octocat/Hello-World.git\",\"mirror_url\":\"git:git.example.com/octocat/Hello-World\",\"hooks_url\":\"https://api.github.com/repos/octocat/Hello-World/hooks\",\"svn_url\":\"https://svn.github.com/octocat/Hello-World\",\"homepage\":\"https://github.com\",\"language\":null,\"forks_count\":9,\"stargazers_count\":80,\"watchers_count\":80,\"size\":108,\"default_branch\":\"master\",\"open_issues_count\":0,\"is_template\":true,\"topics\":[\"octocat\",\"atom\",\"electron\",\"api\"],\"has_issues\":true,\"has_projects\":true,\"has_wiki\":true,\"has_pages\":false,\"has_downloads\":true,\"archived\":false,\"disabled\":false,\"visibility\":\"public\",\"pushed_at\":\"2011-01-26T19:06:43Z\",\"created_at\":\"2011-01-26T19:01:12Z\",\"updated_at\":\"2011-01-26T19:14:43Z\",\"permissions\":{\"admin\":false,\"push\":false,\"pull\":true},\"allow_rebase_merge\":true,\"template_repository\":null,\"temp_clone_token\":\"ABTLWHOULUVAXGTRYU7OC2876QJ2O\",\"allow_squash_merge\":true,\"allow_auto_merge\":false,\"delete_branch_on_merge\":true,\"allow_merge_commit\":true,\"subscribers_count\":42,\"network_count\":0,\"license\":{\"key\":\"mit\",\"name\":\"MIT License\",\"url\":\"https://api.github.com/licenses/mit\",\"spdx_id\":\"MIT\",\"node_id\":\"MDc6TGljZW5zZW1pdA==\",\"html_url\":\"https://github.com/licenses/mit\"},\"forks\":1,\"open_issues\":1,\"watchers\":1},\"author_association\":\"COLLABORATOR\",\"state_reason\":\"completed\"}", @@ -114,6 +118,10 @@ "version": "8.11.0" }, "event": { + "action": "opened", + "category": [ + "configuration" + ], "created": "2022-11-23T15:07:18.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4710\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/events\",\"html_url\":\"https://github.com/elastic/integrations/issues/4710\",\"id\":1461928292,\"node_id\":\"I_kwDODAw23M5XI0Fk\",\"number\":4710,\"title\":\"Custom STIX Package\",\"user\":{\"login\":\"jamiehynds\",\"id\":62879768,\"node_id\":\"MDQ6VXNlcjYyODc5NzY4\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/62879768?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/jamiehynds\",\"html_url\":\"https://github.com/jamiehynds\",\"followers_url\":\"https://api.github.com/users/jamiehynds/followers\",\"following_url\":\"https://api.github.com/users/jamiehynds/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/jamiehynds/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/jamiehynds/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/jamiehynds/subscriptions\",\"organizations_url\":\"https://api.github.com/users/jamiehynds/orgs\",\"repos_url\":\"https://api.github.com/users/jamiehynds/repos\",\"events_url\":\"https://api.github.com/users/jamiehynds/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/jamiehynds/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":3104073484,\"node_id\":\"MDU6TGFiZWwzMTA0MDczNDg0\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:Threat%20Intel\",\"name\":\"Integration:Threat Intel\",\"color\":\"ffffff\",\"default\":false,\"description\":\"\"}],\"state\":\"open\",\"locked\":false,\"assignee\":{\"login\":\"P1llus\",\"id\":8027539,\"node_id\":\"MDQ6VXNlcjgwMjc1Mzk=\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/8027539?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/P1llus\",\"html_url\":\"https://github.com/P1llus\",\"followers_url\":\"https://api.github.com/users/P1llus/followers\",\"following_url\":\"https://api.github.com/users/P1llus/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/P1llus/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/P1llus/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/P1llus/subscriptions\",\"organizations_url\":\"https://api.github.com/users/P1llus/orgs\",\"repos_url\":\"https://api.github.com/users/P1llus/repos\",\"events_url\":\"https://api.github.com/users/P1llus/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/P1llus/received_events\",\"type\":\"User\",\"site_admin\":false},\"assignees\":[{\"login\":\"P1llus\",\"id\":8027539,\"node_id\":\"MDQ6VXNlcjgwMjc1Mzk=\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/8027539?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/P1llus\",\"html_url\":\"https://github.com/P1llus\",\"followers_url\":\"https://api.github.com/users/P1llus/followers\",\"following_url\":\"https://api.github.com/users/P1llus/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/P1llus/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/P1llus/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/P1llus/subscriptions\",\"organizations_url\":\"https://api.github.com/users/P1llus/orgs\",\"repos_url\":\"https://api.github.com/users/P1llus/repos\",\"events_url\":\"https://api.github.com/users/P1llus/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/P1llus/received_events\",\"type\":\"User\",\"site_admin\":false}],\"milestone\":null,\"comments\":2,\"created_at\":\"2022-11-23T15:06:34Z\",\"updated_at\":\"2022-11-23T15:07:18Z\",\"closed_at\":null,\"author_association\":\"NONE\",\"active_lock_reason\":null,\"body\":\"Structured Threat Information Expression (STIX) is a language for expressing cyber threat and observable information. While we have several Threat Intel integrations which map STIX formatted data to Elastic Common Schema, users will always have need to ingest IOC's from threat feeds that we don't support out of the box. 'How do I ingest STIX feeds' remains a very common questions across community Slack, Discuss, Github, etc. A custom package would solve for this. \\r\\n\\r\\nTo allow for the broad range of STIX formatted feeds, we should provide a way for users to ingest data from ANY STIX feed, via a 'Custom STIX' package. The package will leverage our httpjson input under the hood, but include an ingest pipeline which maps STIX fields to ECS (we expect there'll still be a need for custom fields, as not all STIX fields have a corresponding field in ECS). \\r\\n\\r\\nThere may be cases where some feeds/vendors don't strictly conform to STIX, and in those cases, users may have to modify our pipeline and that's ok. We'll focus on correctly formatted STIX data. \",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/timeline\",\"performed_via_github_app\":null,\"state_reason\":null}", @@ -208,6 +216,10 @@ "version": "8.11.0" }, "event": { + "action": "opened", + "category": [ + "configuration" + ], "created": "2022-11-23T14:58:03.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4707\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/events\",\"html_url\":\"https://github.com/elastic/integrations/issues/4707\",\"id\":1461726255,\"node_id\":\"I_kwDODAw23M5XICwv\",\"number\":4707,\"title\":\"[ Crowdstrike Falcon ] Parse of process field is wrong.\",\"user\":{\"login\":\"leandrojmp\",\"id\":322886,\"node_id\":\"MDQ6VXNlcjMyMjg4Ng==\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/322886?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/leandrojmp\",\"html_url\":\"https://github.com/leandrojmp\",\"followers_url\":\"https://api.github.com/users/leandrojmp/followers\",\"following_url\":\"https://api.github.com/users/leandrojmp/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/leandrojmp/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/leandrojmp/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/leandrojmp/subscriptions\",\"organizations_url\":\"https://api.github.com/users/leandrojmp/orgs\",\"repos_url\":\"https://api.github.com/users/leandrojmp/repos\",\"events_url\":\"https://api.github.com/users/leandrojmp/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/leandrojmp/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":2716642190,\"node_id\":\"MDU6TGFiZWwyNzE2NjQyMTkw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:Crowdstrike\",\"name\":\"Integration:Crowdstrike\",\"color\":\"FFFFFF\",\"default\":false,\"description\":null}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":1,\"created_at\":\"2022-11-23T13:03:54Z\",\"updated_at\":\"2022-11-23T14:58:03Z\",\"closed_at\":null,\"author_association\":\"NONE\",\"active_lock_reason\":null,\"body\":\"Hello,\\r\\n\\r\\nThe parse of the process fields in the Crowdstrike Falcon Pipeline is wrong, it is creating fields with dots in the name instead of nested json objects.\\r\\n\\r\\nIt creates this:\\r\\n```\\r\\n{\\r\\n \\\"process.executable\\\": \\\"value\\\"\\r\\n}\\r\\n```\\r\\n\\r\\nInstead of\\r\\n\\r\\n```\\r\\n{\\r\\n \\\"process\\\": {\\r\\n \\\"executable\\\": \\\"value\\\"\\r\\n }\\r\\n}\\r\\n```\\r\\n\\r\\nThis same issue was present in the [filebeat integration](https://github.com/elastic/beats/issues/27622) and I submitted a [fix](https://github.com/elastic/beats/pull/27623) more than an year ago.\\r\\n\\r\\nI will submit a PR later with the same fix, but I'm creating this issue to register the problem.\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", @@ -283,6 +295,10 @@ "version": "8.11.0" }, "event": { + "action": "opened", + "category": [ + "configuration" + ], "created": "2022-11-23T11:15:48.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4704\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/events\",\"html_url\":\"https://github.com/elastic/integrations/pull/4704\",\"id\":1461524465,\"node_id\":\"PR_kwDODAw23M5DjMOh\",\"number\":4704,\"title\":\"[Enhancement] [Infoblox Bloxone DDI] Update the Pagination Termination Condition and Added Filter instead of KQL in visualizations\",\"user\":{\"login\":\"vinit-elastic\",\"id\":89848047,\"node_id\":\"MDQ6VXNlcjg5ODQ4MDQ3\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/89848047?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/vinit-elastic\",\"html_url\":\"https://github.com/vinit-elastic\",\"followers_url\":\"https://api.github.com/users/vinit-elastic/followers\",\"following_url\":\"https://api.github.com/users/vinit-elastic/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/vinit-elastic/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/vinit-elastic/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/vinit-elastic/subscriptions\",\"organizations_url\":\"https://api.github.com/users/vinit-elastic/orgs\",\"repos_url\":\"https://api.github.com/users/vinit-elastic/repos\",\"events_url\":\"https://api.github.com/users/vinit-elastic/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/vinit-elastic/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":1498531540,\"node_id\":\"MDU6TGFiZWwxNDk4NTMxNTQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/enhancement\",\"name\":\"enhancement\",\"color\":\"a2eeef\",\"default\":true,\"description\":\"New feature or request\"},{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":4528694847,\"node_id\":\"LA_kwDODAw23M8AAAABDe5mPw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:infoblox_bloxone_ddi\",\"name\":\"Integration:infoblox_bloxone_ddi\",\"color\":\"FFFFFF\",\"default\":false,\"description\":\"Infoblox BloxOne DDI (DNS, DHCP, IP management)\"}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":4,\"created_at\":\"2022-11-23T10:57:54Z\",\"updated_at\":\"2022-11-23T11:15:48Z\",\"closed_at\":null,\"author_association\":\"COLLABORATOR\",\"active_lock_reason\":null,\"draft\":false,\"pull_request\":{\"url\":\"https://api.github.com/repos/elastic/integrations/pulls/4704\",\"html_url\":\"https://github.com/elastic/integrations/pull/4704\",\"diff_url\":\"https://github.com/elastic/integrations/pull/4704.diff\",\"patch_url\":\"https://github.com/elastic/integrations/pull/4704.patch\",\"merged_at\":null},\"body\":\" Type of change\\r\\n- Enhancement\\r\\n\\r\\n\\r\\n## What does this PR do?\\r\\nUpdate the Pagination Termination Condition for Infoblox Bloxone DDI connector.\\r\\n\\r\\nCurrent condition for pagination termination contains `[[else]][[.last_response.terminate_pagination]][[end]]` which results in error logs when pagination is completed.\\r\\n\\r\\nRemoving this `else` condition will not result in error logs.\\r\\n\\r\\n\\r\\n\\r\\n## Checklist\\r\\n\\r\\n- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.\\r\\n- [x] I have verified that all data streams collect metrics or logs.\\r\\n- [x] I have added an entry to my package's `changelog.yml` file.\\r\\n- [x] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).\\r\\n\\r\\n\\r\\n\\r\\n## How to test this PR locally\\r\\n- Clone integrations repo.\\r\\n- Install elastic package locally.\\r\\n- Start elastic stack using elastic-package.\\r\\n- Move to integrations/packages/infoblox_bloxone_ddi directory.\\r\\n- Run the following command to run tests. \\r\\n> elastic-package test \\r\\n\\r\\n\\r\\n## Related issues\\r\\n\\r\\n\\r\\n- Relates https://github.com/elastic/integrations/issues/4527\\r\\n\\r\\n## Screenshots\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529720-18c110cd-5343-4d70-bbfb-eed0b81313af.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529765-4b183071-6ed9-4bc8-8a98-fd04955bb4d7.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529819-78128d98-630e-49e5-bf97-f86059c0cc26.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529936-df7e3d6f-031e-4b0c-992f-93707a507735.png)\\r\\n\\r\\n\\r\\n\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", @@ -370,6 +386,10 @@ "version": "8.11.0" }, "event": { + "action": "opened", + "category": [ + "configuration" + ], "created": "2022-11-23T11:23:56.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4703\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/events\",\"html_url\":\"https://github.com/elastic/integrations/pull/4703\",\"id\":1461503410,\"node_id\":\"PR_kwDODAw23M5DjHjk\",\"number\":4703,\"title\":\"[Enhancement] [AWS Security Hub] Update the Pagination Termination Condition\",\"user\":{\"login\":\"vinit-elastic\",\"id\":89848047,\"node_id\":\"MDQ6VXNlcjg5ODQ4MDQ3\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/89848047?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/vinit-elastic\",\"html_url\":\"https://github.com/vinit-elastic\",\"followers_url\":\"https://api.github.com/users/vinit-elastic/followers\",\"following_url\":\"https://api.github.com/users/vinit-elastic/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/vinit-elastic/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/vinit-elastic/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/vinit-elastic/subscriptions\",\"organizations_url\":\"https://api.github.com/users/vinit-elastic/orgs\",\"repos_url\":\"https://api.github.com/users/vinit-elastic/repos\",\"events_url\":\"https://api.github.com/users/vinit-elastic/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/vinit-elastic/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":1498531540,\"node_id\":\"MDU6TGFiZWwxNDk4NTMxNTQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/enhancement\",\"name\":\"enhancement\",\"color\":\"a2eeef\",\"default\":true,\"description\":\"New feature or request\"},{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":2607750240,\"node_id\":\"MDU6TGFiZWwyNjA3NzUwMjQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:AWS\",\"name\":\"Integration:AWS\",\"color\":\"FFFFFF\",\"default\":false,\"description\":\"\"}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":4,\"created_at\":\"2022-11-23T10:44:59Z\",\"updated_at\":\"2022-11-23T11:23:56Z\",\"closed_at\":null,\"author_association\":\"COLLABORATOR\",\"active_lock_reason\":null,\"draft\":false,\"pull_request\":{\"url\":\"https://api.github.com/repos/elastic/integrations/pulls/4703\",\"html_url\":\"https://github.com/elastic/integrations/pull/4703\",\"diff_url\":\"https://github.com/elastic/integrations/pull/4703.diff\",\"patch_url\":\"https://github.com/elastic/integrations/pull/4703.patch\",\"merged_at\":null},\"body\":\" Type of change\\r\\n- Enhancement\\r\\n\\r\\n\\r\\n## What does this PR do?\\r\\nUpdate the Pagination Termination Condition for AWS Security Hub connector.\\r\\n\\r\\nCurrent condition for pagination termination contains `[[else]][[.last_response.terminate_pagination]][[end]]` which results in error logs when pagination is completed.\\r\\n\\r\\nRemoving this `else` condition will not result in error logs.\\r\\n\\r\\n\\r\\n\\r\\n## Checklist\\r\\n\\r\\n- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.\\r\\n- [x] I have verified that all data streams collect metrics or logs.\\r\\n- [x] I have added an entry to my package's `changelog.yml` file.\\r\\n- [x] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).\\r\\n\\r\\n\\r\\n\\r\\n## How to test this PR locally\\r\\n- Clone integrations repo.\\r\\n- Install elastic package locally.\\r\\n- Start elastic stack using elastic-package.\\r\\n- Move to integrations/packages/aws directory.\\r\\n- Run the following command to run tests. \\r\\n> elastic-package test \\r\\n\\r\\n\\r\\n## Related issues\\r\\n\\r\\n\\r\\n- Relates https://github.com/elastic/integrations/issues/4527\\r\\n\\r\\n## Screenshots\\r\\n![image](https://user-images.githubusercontent.com/89848047/203526900-06519c95-3de5-4f88-a65d-555d03d7f9a1.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203527000-b050f059-03c6-4ead-a88e-9f2e42efb537.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203527123-ea1f8513-8371-4d06-8a17-b71c0dae7a5a.png)\\r\\n\\r\\n\\r\\n\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", diff --git a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml index fc7738b2a10..e7e87a7abda 100644 --- a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml @@ -26,6 +26,10 @@ processors: - set: field: event.kind value: event + - append: + field: event.category + value: configuration + tag: append_configuration_into_event_category - append: field: event.type value: creation @@ -38,6 +42,21 @@ processors: field: event.type value: change if: ctx.github?.issues?.created_at != ctx.github?.issues?.updated_at && ctx.github?.issues?.closed_at == null && ctx.github?.issues?.pull_request?.merged_at == null + - set: + field: event.action + value: reopened + tag: set_event_action_reopened + if: ctx.github?.issues?.state == 'open' && ctx.github?.issues?.state_reason == 'reopened' + - set: + field: event.action + value: opened + tag: set_event_action_opened + if: ctx.github?.issues?.state == 'open' && ctx.github?.issues?.state_reason != 'reopened' + - set: + field: event.action + value: closed + tag: set_event_action_closed + if: ctx.github?.issues?.state == 'closed' - date: field: github.issues.updated_at formats: diff --git a/packages/github/data_stream/issues/sample_event.json b/packages/github/data_stream/issues/sample_event.json index 13da3db6cf9..70ecfa8085e 100644 --- a/packages/github/data_stream/issues/sample_event.json +++ b/packages/github/data_stream/issues/sample_event.json @@ -1,30 +1,34 @@ { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "e2949142-e6a4-47dc-a8af-d07a247d37d0", - "id": "2667fb13-13c1-4632-bdeb-e8da7d3cae48", - "name": "elastic-agent-93776", + "ephemeral_id": "b894372a-ceaa-4356-b3d6-eebeba570b5b", + "id": "898b45df-dcc1-4320-8db4-548f37c98c5f", + "name": "elastic-agent-67548", "type": "filebeat", "version": "8.19.10" }, "data_stream": { "dataset": "github.issues", - "namespace": "90057", + "namespace": "97510", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "2667fb13-13c1-4632-bdeb-e8da7d3cae48", + "id": "898b45df-dcc1-4320-8db4-548f37c98c5f", "snapshot": false, "version": "8.19.10" }, "event": { + "action": "opened", "agent_id_status": "verified", + "category": [ + "configuration" + ], "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2026-03-31T09:12:47Z", + "ingested": "2026-07-22T10:09:35Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", "type": [ diff --git a/packages/github/docs/README.md b/packages/github/docs/README.md index 03c533fefe8..260e65e005b 100644 --- a/packages/github/docs/README.md +++ b/packages/github/docs/README.md @@ -949,30 +949,34 @@ An example event for `issues` looks as following: { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "e2949142-e6a4-47dc-a8af-d07a247d37d0", - "id": "2667fb13-13c1-4632-bdeb-e8da7d3cae48", - "name": "elastic-agent-93776", + "ephemeral_id": "b894372a-ceaa-4356-b3d6-eebeba570b5b", + "id": "898b45df-dcc1-4320-8db4-548f37c98c5f", + "name": "elastic-agent-67548", "type": "filebeat", "version": "8.19.10" }, "data_stream": { "dataset": "github.issues", - "namespace": "90057", + "namespace": "97510", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "2667fb13-13c1-4632-bdeb-e8da7d3cae48", + "id": "898b45df-dcc1-4320-8db4-548f37c98c5f", "snapshot": false, "version": "8.19.10" }, "event": { + "action": "opened", "agent_id_status": "verified", + "category": [ + "configuration" + ], "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2026-03-31T09:12:47Z", + "ingested": "2026-07-22T10:09:35Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", "type": [ diff --git a/packages/github/manifest.yml b/packages/github/manifest.yml index 40351b17a53..0e4257c5d38 100644 --- a/packages/github/manifest.yml +++ b/packages/github/manifest.yml @@ -1,6 +1,6 @@ name: github title: GitHub -version: "2.25.0" +version: "2.25.1" description: Collect logs from GitHub with Elastic Agent. type: integration format_version: "3.4.0" diff --git a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml index 4b1dd60d1f5..f1184ca3884 100644 --- a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml @@ -112,7 +112,7 @@ processors: change_calendar_location: configuration print_preview_calendar: configuration change_calendar_timezone: configuration - change_calendar_title: configuration + change_calendar_title: configuration add_subscription: configuration delete_subscription: configuration change_appointment_schedule: configuration From 1ba474d7ce1fb9d9e84e86013cf56aa518c68529 Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Sun, 26 Jul 2026 20:25:56 +0530 Subject: [PATCH 5/9] address comments --- .../test-activitylogs-raw.log-expected.json | 18 +-- ...ime-formats-corner-cases.log-expected.json | 33 ++-- .../elasticsearch/ingest_pipeline/default.yml | 8 +- .../graphactivitylogs/sample_event.json | 3 +- packages/azure/docs/graphactivitylogs.md | 3 +- .../elasticsearch/ingest_pipeline/default.yml | 4 +- .../data_stream/issues/sample_event.json | 12 +- packages/github/docs/README.md | 12 +- .../elasticsearch/ingest_pipeline/default.yml | 142 ++++++------------ .../data_stream/events/sample_event.json | 14 +- packages/jamf_pro/docs/README.md | 14 +- 11 files changed, 93 insertions(+), 170 deletions(-) diff --git a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json index 0e6be070cb6..b89a98124ff 100644 --- a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json +++ b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json @@ -78,8 +78,7 @@ "original": "{\"Level\":4,\"callerIpAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"durationMs\":462680,\"location\":\"West Europe\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e12-268a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe56789-a848-4c93-9d2c-5675972aejk9\",\"durationMs\":462680,\"identityProvider\":\"https://sts.windows.net/a140785b-418d-4344-a4ec-8e9648919gdb/\",\"ipAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"location\":\"West Europe\",\"operationId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"requestId\":\"f7739da0-e6d1-4e3f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/organization/a140785b-418d-4344-a4ec-8e9648919gdb?$select=Id,DisplayName,CreatedDateTime,ReplicationScope,Country,CountryLetterCode,DataBoundary\",\"responseSizeBytes\":364,\"responseStatusCode\":200,\"roles\":\"Organization.Read.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5066-92g3-4b3dfbav50f0\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"a140785b-418d-4344-a4ec-8e9648919gdb\",\"timeGenerated\":\"2024-03-07T11:47:00.6442361Z\",\"tokenIssuedAt\":\"2024-03-07T11:42:00Z\",\"userAgent\":\"python-requests/2.27.1\",\"userId\":null,\"wids\":\"1997b4d3-0g8d-90cb-bhj8-d89n3121e90\"},\"resourceId\":\"/TENANTS/A140785B-418D-4344-A4EC-8E9648919GDB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"a140785b-418d-4344-a4ec-8e9648919gdb\",\"time\":\"2024-03-07T11:47:00.6442361Z\"}", "outcome": "success", "type": [ - "access", - "info" + "access" ] }, "http": { @@ -228,8 +227,7 @@ "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"durationMs\":453011,\"location\":\"Germany West Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e12-268a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe56790-a848-4c83-9d2c-5675972aejk9\",\"durationMs\":453011,\"identityProvider\":\"https://sts.windows.net/aa30985b-427d-4434-b4dc-8f9040719adb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"Germany West Central\",\"operationId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"requestId\":\"f7739jk0-e6d1-4e3f-985a-64937fbge367\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/me/photos/96x96/$value\",\"responseSizeBytes\":294,\"responseStatusCode\":404,\"roles\":null,\"scopes\":\"email openid Organization.Read.All Policy.ReadWrite.ApplicationConfiguration profile User.Read\",\"servicePrincipalId\":null,\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"aa30985b-427d-4434-b4dc-8f9040719adb\",\"timeGenerated\":\"2024-03-07T10:35:31.9597832Z\",\"tokenIssuedAt\":\"2024-03-07T10:30:30Z\",\"userAgent\":\"\",\"userId\":\"b37ec517-0a34-4266-b627-f7bb0d679d70\",\"wids\":\"1997b4d3-0g8d-90cb-bhj5-d80n3122e98 1997b4d3-0f8d-76cb-bhj5-d80n3122e98\"},\"resourceId\":\"/TENANTS/AA30985B-427D-4434-B4DC-8F9040719ADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"404\",\"tenantId\":\"aa30985b-427d-4434-b4dc-8f9040719adb\",\"time\":\"2024-03-07T10:35:31.9597832Z\"}", "outcome": "failure", "type": [ - "access", - "info" + "access" ] }, "http": { @@ -375,8 +373,7 @@ "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.144\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"durationMs\":16688471,\"location\":\"UK South\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"beta\",\"properties\":{\"apiVersion\":\"beta\",\"appId\":\"a5a68e12-268a-3c91-a5f2-b9254e67hb28\",\"atContent\":\"\",\"clientAuthMethod\":\"0\",\"clientRequestId\":\"2fe56789-a848-4c93-9s2c-5675972aghk9\",\"durationMs\":16688471,\"identityProvider\":null,\"ipAddress\":\"81.2.69.144\",\"location\":\"UK South\",\"operationId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"requestId\":\"f7739da0-e6d1-4e3f-875a-64934fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/beta//users/7ef3c2ad-d52l-4a89-8cf9-c30178181027/photos/48x48/$value\",\"responseSizeBytes\":0,\"responseStatusCode\":404,\"roles\":null,\"scopes\":\"AdministrativeUnit.ReadWrite.All AuditLog.Read.All Directory.AccessAsUser.All Directory.Write.Restricted email openid Organization.Read.All Policy.ReadWrite.Authorization profile User.EnableDisableAccount.All User.ReadWrite.All\",\"servicePrincipalId\":null,\"signInActivityId\":\"signin_ActivityId\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"timeGenerated\":\"2024-03-07T16:42:22.84914Z\",\"tokenIssuedAt\":\"2024-03-07T16:37:20Z\",\"userAgent\":\"\",\"userId\":\"285e0849-a706-4a9a-9eb1-f4e21cc78793\",\"wids\":\"1997b4d3-0g8d-90cb-bhj5-d80n3122e98 1997b4d3-0g8d-90cb-bhj5-d80n3122e99 1997b4d3-0g8d-90cb-bhj5-d80n3122e80 1997b4d3-0g8d-90cb-bhj5-d80n3122e83\"},\"resourceId\":\"/TENANTS/AB47545B-420E-46FG-C4DC-8F7697K1AADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"404\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"time\":\"2024-03-07T16:42:22.8491400Z\"}", "outcome": "failure", "type": [ - "access", - "info" + "access" ] }, "http": { @@ -548,8 +545,7 @@ "original": "{\"Level\":4,\"callerIpAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"durationMs\":846544,\"location\":\"UK South\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"beta\",\"properties\":{\"apiVersion\":\"beta\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"0\",\"clientRequestId\":\"2fe56789-a848-4c93-9d2d-5675972ardk9\",\"durationMs\":846544,\"identityProvider\":null,\"ipAddress\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"location\":\"UK South\",\"operationId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"requestId\":\"f7749da0-e6g1-4f3f-975a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/beta/devices?$select=displayName,id,deviceId\\\\u0026$search=%22displayName:a%22\\\\u0026$top=30\",\"responseSizeBytes\":0,\"responseStatusCode\":200,\"roles\":null,\"scopes\":\"AccessReview.ReadWrite.All AuditLog.Read.All ChangeManagement.Read.All ConsentRequest.Create ConsentRequest.Read ConsentRequest.ReadApprove.All ConsentRequest.ReadWrite.All CustomSecAttributeAuditLogs.Read.All Directory.AccessAsUser.All Directory.Read.All Directory.ReadWrite.All Directory.Write.Restricted DirectoryRecommendations.Read.All DirectoryRecommendations.ReadWrite.All email EntitlementManagement.Read.All Group.ReadWrite.All IdentityProvider.ReadWrite.All IdentityRiskEvent.ReadWrite.All IdentityRiskyServicePrincipal.ReadWrite.All IdentityRiskyUser.ReadWrite.All IdentityUserFlow.Read.All LifecycleWorkflows.ReadWrite.All openid Policy.Read.All Policy.Read.IdentityProtection Policy.ReadWrite.AuthenticationFlows Policy.ReadWrite.AuthenticationMethod Policy.ReadWrite.ConditionalAccess Policy.ReadWrite.ExternalIdentities Policy.ReadWrite.IdentityProtection Policy.ReadWrite.MobilityManagement profile Reports.Read.All RoleManagement.ReadWrite.Directory RoleManagement.ReadWrite.Exchange SecurityEvents.ReadWrite.All TrustFrameworkKeySet.Read.All User.Export.All User.ReadWrite.All UserAuthenticationMethod.ReadWrite.All\",\"servicePrincipalId\":null,\"signInActivityId\":\"signin_Activity-Id\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"timeGenerated\":\"2024-03-07T16:42:12.0485843Z\",\"tokenIssuedAt\":\"2024-03-07T16:36:51Z\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0\",\"userId\":\"285e0849-a706-4a9a-9eb1-f4e21cc78793\",\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3122e67 a207b4d3-0g8d-90cb-bhj5-d80n3122e69 a207b4d3-0g8d-90cb-bhj5-d80n3122e89\"},\"resourceId\":\"/TENANTS/AB47545B-420E-46FG-C4DC-8F7697K1AADB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab47545b-420e-46fg-c4dc-8f7697k1aadb\",\"time\":\"2024-03-07T16:42:12.0485843Z\"}", "outcome": "success", "type": [ - "access", - "info" + "access" ] }, "http": { @@ -706,8 +702,7 @@ "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", "outcome": "success", "type": [ - "access", - "info" + "access" ] }, "http": { @@ -861,8 +856,7 @@ "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"C_DeviceId\": \"abc123\",\"c_Sid\":\"xyz000\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", "outcome": "success", "type": [ - "access", - "info" + "access" ] }, "http": { diff --git a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json index 693aa3144fe..15f836c6658 100644 --- a/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json +++ b/packages/azure/data_stream/graphactivitylogs/_dev/test/pipeline/test-time-formats-corner-cases.log-expected.json @@ -23,8 +23,7 @@ "kind": "event", "original": "{\"time\": \"01/09/2007 09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -54,8 +53,7 @@ "kind": "event", "original": "{\"time\": \"1/9/2007 09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -85,8 +83,7 @@ "kind": "event", "original": "{\"time\": \"01/09/2007 09:41:00 AM\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -116,8 +113,7 @@ "kind": "event", "original": "{\"time\": \"1/9/2007 9:41:00 AM\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -147,8 +143,7 @@ "kind": "event", "original": "{\"time\": \"1/9/2007 10:41:00 AM +01:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -178,8 +173,7 @@ "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -209,8 +203,7 @@ "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.22Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -240,8 +233,7 @@ "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.6816663Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -271,8 +263,7 @@ "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.535404056Z\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -302,8 +293,7 @@ "kind": "event", "original": "{\"time\": \"2007-01-09T09:41:00.992099+00:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ @@ -333,8 +323,7 @@ "kind": "event", "original": "{\"time\": \"2007-01-09T11:41:00+02:00\", \"category\": \"MicrosoftGraphActivityLogs\"}", "type": [ - "access", - "info" + "access" ] }, "tags": [ diff --git a/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml index e6f0a9ab279..8bff97688a2 100644 --- a/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml @@ -9,10 +9,6 @@ processors: field: event.kind value: event tag: set-event_kind - - append: - field: event.type - value: access - tag: append-event_type - rename: field: azure target_field: azure-eventhub @@ -429,8 +425,8 @@ processors: allow_duplicates: false - append: field: event.type - value: info - tag: append_info_into_event_type + value: access + tag: append_access_into_event_type allow_duplicates: false if: ctx.http?.request?.method == null || ctx.http.request.method == 'GET' || ctx.http.request.method == 'HEAD' - append: diff --git a/packages/azure/data_stream/graphactivitylogs/sample_event.json b/packages/azure/data_stream/graphactivitylogs/sample_event.json index 220a5bc4d97..57d1a96021b 100644 --- a/packages/azure/data_stream/graphactivitylogs/sample_event.json +++ b/packages/azure/data_stream/graphactivitylogs/sample_event.json @@ -82,8 +82,7 @@ "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", "type": [ - "access", - "info" + "access" ], "category": [ "api" diff --git a/packages/azure/docs/graphactivitylogs.md b/packages/azure/docs/graphactivitylogs.md index 7655dcb42c1..a068abf71ea 100644 --- a/packages/azure/docs/graphactivitylogs.md +++ b/packages/azure/docs/graphactivitylogs.md @@ -166,8 +166,7 @@ An example event for `graphactivitylogs` looks as following: "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", "type": [ - "access", - "info" + "access" ], "category": [ "api" diff --git a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml index e7e87a7abda..d9ddcde1299 100644 --- a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml @@ -46,12 +46,12 @@ processors: field: event.action value: reopened tag: set_event_action_reopened - if: ctx.github?.issues?.state == 'open' && ctx.github?.issues?.state_reason == 'reopened' + if: ctx.github?.issues?.state == 'open' && ctx.github.issues.state_reason == 'reopened' - set: field: event.action value: opened tag: set_event_action_opened - if: ctx.github?.issues?.state == 'open' && ctx.github?.issues?.state_reason != 'reopened' + if: ctx.github?.issues?.state == 'open' && ctx.github.issues.state_reason != 'reopened' - set: field: event.action value: closed diff --git a/packages/github/data_stream/issues/sample_event.json b/packages/github/data_stream/issues/sample_event.json index 70ecfa8085e..848e1e5ad61 100644 --- a/packages/github/data_stream/issues/sample_event.json +++ b/packages/github/data_stream/issues/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "b894372a-ceaa-4356-b3d6-eebeba570b5b", - "id": "898b45df-dcc1-4320-8db4-548f37c98c5f", - "name": "elastic-agent-67548", + "ephemeral_id": "d8a50fcb-cdf2-4d73-8a4a-cb5a2812f250", + "id": "a9884168-c5a2-4d45-b7a8-cca26df090d2", + "name": "elastic-agent-96514", "type": "filebeat", "version": "8.19.10" }, "data_stream": { "dataset": "github.issues", - "namespace": "97510", + "namespace": "70003", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "898b45df-dcc1-4320-8db4-548f37c98c5f", + "id": "a9884168-c5a2-4d45-b7a8-cca26df090d2", "snapshot": false, "version": "8.19.10" }, @@ -28,7 +28,7 @@ ], "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2026-07-22T10:09:35Z", + "ingested": "2026-07-26T14:44:15Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", "type": [ diff --git a/packages/github/docs/README.md b/packages/github/docs/README.md index 260e65e005b..316090fb669 100644 --- a/packages/github/docs/README.md +++ b/packages/github/docs/README.md @@ -949,22 +949,22 @@ An example event for `issues` looks as following: { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "b894372a-ceaa-4356-b3d6-eebeba570b5b", - "id": "898b45df-dcc1-4320-8db4-548f37c98c5f", - "name": "elastic-agent-67548", + "ephemeral_id": "d8a50fcb-cdf2-4d73-8a4a-cb5a2812f250", + "id": "a9884168-c5a2-4d45-b7a8-cca26df090d2", + "name": "elastic-agent-96514", "type": "filebeat", "version": "8.19.10" }, "data_stream": { "dataset": "github.issues", - "namespace": "97510", + "namespace": "70003", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "898b45df-dcc1-4320-8db4-548f37c98c5f", + "id": "a9884168-c5a2-4d45-b7a8-cca26df090d2", "snapshot": false, "version": "8.19.10" }, @@ -976,7 +976,7 @@ An example event for `issues` looks as following: ], "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2026-07-22T10:09:35Z", + "ingested": "2026-07-26T14:44:15Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", "type": [ diff --git a/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml index e9b3b73f4df..93ffed0fced 100644 --- a/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -182,104 +182,50 @@ processors: copy_from: jamf_pro.events.webhook.webhook_event ignore_empty_value: true -# event.category — keyed on event.action -- append: - field: event.category - tag: append_host_into_event_category - value: host - if: >- - ctx.event?.action != null && - ['ComputerAdded', 'ComputerCheckIn', 'ComputerInventoryCompleted', - 'ComputerPushCapabilityChanged', 'MobileDeviceEnrolled', - 'MobileDeviceUnEnrolled', 'MobileDeviceCheckIn', - 'MobileDeviceInventoryCompleted', 'MobileDeviceCommandCompleted', - 'MobileDevicePushSent', 'DeviceAddedToDEP', 'PushSent', 'SCEPChallenge', - 'SmartGroupComputerMembershipChange', - 'SmartGroupMobileDeviceMembershipChange', 'JSSStartup', - 'JSSShutdown'].contains(ctx.event.action) -- append: - field: event.category - tag: append_configuration_into_event_category - value: configuration - if: >- - ctx.event?.action != null && - ['ComputerPolicyFinished', 'ComputerPatchPolicyCompleted', - 'PatchSoftwareTitleUpdated'].contains(ctx.event.action) -- append: - field: event.category - tag: append_package_into_event_category - value: package - if: >- - ctx.event?.action != null && - ['ComputerPatchPolicyCompleted', 'PatchSoftwareTitleUpdated'].contains(ctx.event.action) -- append: - field: event.category - tag: append_api_into_event_category - value: api - if: ctx.event?.action == 'RestAPIOperation' -- append: - field: event.category - tag: append_iam_into_event_category - value: iam - if: >- - ctx.event?.action != null && - ['SmartGroupComputerMembershipChange', - 'SmartGroupMobileDeviceMembershipChange', - 'SmartGroupUserMembershipChange'].contains(ctx.event.action) -- append: - field: event.category - tag: append_authentication_into_event_category - value: authentication - if: ctx.event?.action == 'SCEPChallenge' - -# event.type — keyed on event.action -- append: - field: event.type - tag: append_change_into_event_type - value: change - if: >- - ctx.event?.action != null && - ['ComputerAdded', 'ComputerPushCapabilityChanged', - 'ComputerPolicyFinished', 'ComputerPatchPolicyCompleted', - 'MobileDeviceEnrolled', 'MobileDeviceUnEnrolled', - 'MobileDeviceCommandCompleted', 'DeviceAddedToDEP', - 'PatchSoftwareTitleUpdated', 'RestAPIOperation', - 'SmartGroupComputerMembershipChange', - 'SmartGroupMobileDeviceMembershipChange', - 'SmartGroupUserMembershipChange'].contains(ctx.event.action) -- append: - field: event.type - tag: append_end_into_event_type - value: end - if: >- - ctx.event?.action != null && - ['MobileDeviceUnEnrolled', 'MobileDeviceCommandCompleted', - 'JSSShutdown'].contains(ctx.event.action) -- append: - field: event.type - tag: append_start_into_event_type - value: start - if: >- - ctx.event?.action != null && - ['SCEPChallenge', 'JSSStartup'].contains(ctx.event.action) -- append: - field: event.type - tag: append_admin_into_event_type - value: admin - if: ctx.event?.action == 'RestAPIOperation' -- append: - field: event.type - tag: append_group_into_event_type - value: group - if: >- - ctx.event?.action != null && - ['SmartGroupComputerMembershipChange', - 'SmartGroupMobileDeviceMembershipChange', - 'SmartGroupUserMembershipChange'].contains(ctx.event.action) -- append: - field: event.type - tag: append_info_default_into_event_type - value: info +# event.category and event.type — keyed on event.action via a lookup table. +- script: + tag: script_set_event_category_and_type + lang: painless + description: Set event.category and event.type from a table keyed on the Jamf webhook event (event.action). + params: + actions: + ComputerAdded: { category: [host], type: [change] } + ComputerCheckIn: { category: [host], type: [] } + ComputerInventoryCompleted: { category: [host], type: [] } + ComputerPushCapabilityChanged: { category: [host], type: [change] } + MobileDeviceEnrolled: { category: [host], type: [change] } + MobileDeviceUnEnrolled: { category: [host], type: [change, end] } + MobileDeviceCheckIn: { category: [host], type: [] } + MobileDeviceInventoryCompleted: { category: [host], type: [] } + MobileDeviceCommandCompleted: { category: [host], type: [change, end] } + MobileDevicePushSent: { category: [host], type: [] } + DeviceAddedToDEP: { category: [host], type: [change] } + PushSent: { category: [host], type: [] } + SCEPChallenge: { category: [host, authentication], type: [start] } + SmartGroupComputerMembershipChange: { category: [host, iam], type: [change, group] } + SmartGroupMobileDeviceMembershipChange: { category: [host, iam], type: [change, group] } + JSSStartup: { category: [host], type: [start] } + JSSShutdown: { category: [host], type: [end] } + ComputerPolicyFinished: { category: [configuration], type: [change] } + ComputerPatchPolicyCompleted: { category: [configuration, package], type: [change] } + PatchSoftwareTitleUpdated: { category: [configuration, package], type: [change] } + RestAPIOperation: { category: [api], type: [change, admin] } + SmartGroupUserMembershipChange: { category: [iam], type: [change, group] } + source: |- + def cats = new ArrayList(); + def types = new ArrayList(); + def action = ctx.event?.action; + if (action != null) { + def entry = params.actions.get(action); + if (entry != null) { + if (entry.category != null) { cats.addAll(entry.category); } + if (entry.type != null) { types.addAll(entry.type); } + } + } + types.add('info'); + ctx.event = ctx.event ?: [:]; + if (!cats.isEmpty()) { ctx.event.category = cats; } + ctx.event.type = types; - set: field: event.outcome diff --git a/packages/jamf_pro/data_stream/events/sample_event.json b/packages/jamf_pro/data_stream/events/sample_event.json index 72d6452e02a..a8c2e5c29d5 100644 --- a/packages/jamf_pro/data_stream/events/sample_event.json +++ b/packages/jamf_pro/data_stream/events/sample_event.json @@ -1,22 +1,22 @@ { - "@timestamp": "2026-07-21T17:37:04.022Z", + "@timestamp": "2026-07-26T14:37:39.817Z", "agent": { - "ephemeral_id": "5e4d40af-0b00-44c6-8b69-21ab15fb467e", - "id": "70a5daad-17e0-4285-8ac4-324572156b0d", - "name": "elastic-agent-61007", + "ephemeral_id": "7ff99866-0db2-4af0-8cd5-51957007a61c", + "id": "77cd4886-245a-43a6-a4eb-0a2737915527", + "name": "elastic-agent-62101", "type": "filebeat", "version": "8.19.2" }, "data_stream": { "dataset": "jamf_pro.events", - "namespace": "15745", + "namespace": "78205", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "70a5daad-17e0-4285-8ac4-324572156b0d", + "id": "77cd4886-245a-43a6-a4eb-0a2737915527", "snapshot": false, "version": "8.19.2" }, @@ -27,7 +27,7 @@ "host" ], "dataset": "jamf_pro.events", - "ingested": "2026-07-21T17:37:05Z", + "ingested": "2026-07-26T14:37:40Z", "kind": "event", "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}", "type": [ diff --git a/packages/jamf_pro/docs/README.md b/packages/jamf_pro/docs/README.md index 4e43bdb7a17..d88b42c7771 100644 --- a/packages/jamf_pro/docs/README.md +++ b/packages/jamf_pro/docs/README.md @@ -393,24 +393,24 @@ An example event for `events` looks as following: ```json { - "@timestamp": "2026-07-21T17:37:04.022Z", + "@timestamp": "2026-07-26T14:37:39.817Z", "agent": { - "ephemeral_id": "5e4d40af-0b00-44c6-8b69-21ab15fb467e", - "id": "70a5daad-17e0-4285-8ac4-324572156b0d", - "name": "elastic-agent-61007", + "ephemeral_id": "7ff99866-0db2-4af0-8cd5-51957007a61c", + "id": "77cd4886-245a-43a6-a4eb-0a2737915527", + "name": "elastic-agent-62101", "type": "filebeat", "version": "8.19.2" }, "data_stream": { "dataset": "jamf_pro.events", - "namespace": "15745", + "namespace": "78205", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "70a5daad-17e0-4285-8ac4-324572156b0d", + "id": "77cd4886-245a-43a6-a4eb-0a2737915527", "snapshot": false, "version": "8.19.2" }, @@ -421,7 +421,7 @@ An example event for `events` looks as following: "host" ], "dataset": "jamf_pro.events", - "ingested": "2026-07-21T17:37:05Z", + "ingested": "2026-07-26T14:37:40Z", "kind": "event", "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}", "type": [ From c88a4ae6134479010d564e60f4225c99b5e9f5be Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Mon, 27 Jul 2026 12:32:06 +0530 Subject: [PATCH 6/9] add comments to describe event.type mapping changes --- .../issues/elasticsearch/ingest_pipeline/default.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml index d9ddcde1299..1a9cfe49953 100644 --- a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml @@ -30,14 +30,19 @@ processors: field: event.category value: configuration tag: append_configuration_into_event_category + # The API returns a snapshot of the issue's current state, not a discrete action, so + # event.type is inferred from timestamps. `creation` applies only while the issue has + # never been modified; reopened and closed issues have updated_at > created_at. - append: field: event.type value: creation if: ctx.github?.issues?.created_at == ctx.github?.issues?.updated_at + # A closed issue or a merged pull request has reached the end of its lifecycle. - append: field: event.type value: deletion if: ctx.github?.issues?.closed_at != null || ctx.github?.issues?.pull_request?.merged_at != null + # Anything still open but modified since it was created has been edited or reopened. - append: field: event.type value: change From fed75d7464dec8e01cb397390252e550ae1912fd Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Wed, 29 Jul 2026 09:50:18 +0530 Subject: [PATCH 7/9] address review comments, remove event.category mapping when no suitable ECS option is available --- .../graphactivitylogs/sample_event.json | 11 +-- packages/azure/docs/graphactivitylogs.md | 11 +-- packages/github/changelog.yml | 2 +- .../test-github-issues-json.log-expected.json | 15 --- .../elasticsearch/ingest_pipeline/default.yml | 4 - .../data_stream/issues/sample_event.json | 15 ++- packages/github/docs/README.md | 15 ++- .../pipeline/test-calendar.log-expected.json | 9 -- .../elasticsearch/ingest_pipeline/default.yml | 36 +++----- .../data_stream/calendar/sample_event.json | 12 +-- .../test/pipeline/test-chat.log-expected.json | 6 -- .../elasticsearch/ingest_pipeline/default.yml | 13 ++- .../data_stream/chat/sample_event.json | 12 +-- .../elasticsearch/ingest_pipeline/default.yml | 10 +- .../data_stream/chrome/sample_event.json | 12 +-- .../pipeline/test-device.log-expected.json | 1 - .../elasticsearch/ingest_pipeline/default.yml | 4 +- .../data_stream/device/sample_event.json | 14 +-- .../elasticsearch/ingest_pipeline/default.yml | 2 +- .../group_enterprise/sample_event.json | 14 +-- .../elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/login/sample_event.json | 14 +-- .../elasticsearch/ingest_pipeline/default.yml | 5 - .../data_stream/rules/sample_event.json | 14 +-- packages/google_workspace/docs/README.md | 92 +++++++++---------- .../test-computer-added.json-expected.json | 3 +- ...-patch-policy-completed.json-expected.json | 3 +- ...omputer-policy-finished.json-expected.json | 3 +- ...push-capability-changed.json-expected.json | 3 +- ...est-device-added-to-dep.json-expected.json | 3 +- .../test-jss-shutdown.json-expected.json | 3 +- .../test-jss-startup.json-expected.json | 3 +- ...evice-command-completed.json-expected.json | 3 +- ...-mobile-device-enrolled.json-expected.json | 2 +- ...obile-device-unenrolled.json-expected.json | 3 +- ...-software-title-updated.json-expected.json | 3 +- ...test-rest-api-operation.json-expected.json | 3 +- .../test-scep-challenge.json-expected.json | 3 +- ...puter-membership-change.json-expected.json | 3 +- ...evice-membership-change.json-expected.json | 3 +- ...-user-membership-change.json-expected.json | 3 +- .../elasticsearch/ingest_pipeline/default.yml | 22 +++-- .../data_stream/events/sample_event.json | 17 ++-- packages/jamf_pro/docs/README.md | 17 ++-- .../elasticsearch/ingest_pipeline/default.yml | 6 ++ .../data_stream/audit/sample_event.json | 12 +-- packages/sublime_security/docs/README.md | 12 +-- 47 files changed, 207 insertions(+), 271 deletions(-) diff --git a/packages/azure/data_stream/graphactivitylogs/sample_event.json b/packages/azure/data_stream/graphactivitylogs/sample_event.json index 57d1a96021b..82cd191bd75 100644 --- a/packages/azure/data_stream/graphactivitylogs/sample_event.json +++ b/packages/azure/data_stream/graphactivitylogs/sample_event.json @@ -78,17 +78,16 @@ }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 1213372224, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", + "outcome": "success", "type": [ "access" - ], - "category": [ - "api" - ], - "outcome": "success", - "id": "f7839da0-e7d1-4e4f-985a-64937fbge347" + ] }, "http": { "request": { diff --git a/packages/azure/docs/graphactivitylogs.md b/packages/azure/docs/graphactivitylogs.md index a068abf71ea..68a52285930 100644 --- a/packages/azure/docs/graphactivitylogs.md +++ b/packages/azure/docs/graphactivitylogs.md @@ -162,17 +162,16 @@ An example event for `graphactivitylogs` looks as following: }, "event": { "action": "Microsoft Graph Activity", + "category": [ + "api" + ], "duration": 1213372224, "kind": "event", "original": "{\"Level\":4,\"callerIpAddress\":\"81.2.69.143\",\"category\":\"MicrosoftGraphActivityLogs\",\"correlationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"durationMs\":1100725,\"location\":\"France Central\",\"operationName\":\"Microsoft Graph Activity\",\"operationVersion\":\"v1.0\",\"properties\":{\"apiVersion\":\"v1.0\",\"appId\":\"a5a68e32-269a-3c91-a5e2-b9254e67hb29\",\"atContent\":\"\",\"clientAuthMethod\":\"2\",\"clientRequestId\":\"2fe58790-a848-4a93-9d2c-5645972aejk9\",\"durationMs\":1100725,\"identityProvider\":\"https://sts.windows.net/ab30785b-417f-42a4-b5dc-8f9051718acb/\",\"ipAddress\":\"81.2.69.143\",\"location\":\"France Central\",\"operationId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestId\":\"f7839da0-e7d1-4e4f-985a-64937fbge347\",\"requestMethod\":\"GET\",\"requestUri\":\"https://graph.microsoft.com/v1.0/directoryRoles\",\"responseSizeBytes\":4300,\"responseStatusCode\":200,\"roles\":\"Application.Read.All Domain.Read.All GroupMember.Read.All LicenseAssignment.ReadWrite.All Organization.Read.All Policy.Read.ConditionalAccess RoleManagement.Read.Directory Team.ReadBasic.All TeamsTab.Create TeamsTab.Read.All TeamsTab.ReadWrite.All User.Read.All\",\"scopes\":null,\"servicePrincipalId\":\"f2aq4c71-31e3-5065-91g3-4b2dfbsv50fg\",\"signInActivityId\":\"sign-in_ActivityId\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"timeGenerated\":\"2024-03-07T10:24:44.7939418Z\",\"tokenIssuedAt\":\"2024-03-07T10:19:44Z\",\"userAgent\":\"\",\"userId\":null,\"wids\":\"a207b4d3-0g8d-90cb-bhj5-d80n3121e69\"},\"resourceId\":\"/TENANTS/AB30785B-417F-42A4-B5DC-8F9051718ACB/PROVIDERS/MICROSOFT.AADIAM\",\"resultSignature\":\"200\",\"tenantId\":\"ab30785b-417f-42a4-b5dc-8f9051718acb\",\"time\":\"2024-03-07T10:24:44.7939418Z\"}", + "outcome": "success", "type": [ "access" - ], - "category": [ - "api" - ], - "outcome": "success", - "id": "f7839da0-e7d1-4e4f-985a-64937fbge347" + ] }, "http": { "request": { diff --git a/packages/github/changelog.yml b/packages/github/changelog.yml index 7d5bc3cb265..ed0892d7400 100644 --- a/packages/github/changelog.yml +++ b/packages/github/changelog.yml @@ -1,7 +1,7 @@ # newer versions go on top - version: "2.25.2" changes: - - description: Add ECS event categorization fields to the `issues` data stream. + - description: Add `event.action` to the `issues` data stream. type: bugfix link: https://github.com/elastic/integrations/pull/20276 - version: "2.25.1" diff --git a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json index 0f6c826f1b6..e97d39db933 100644 --- a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json +++ b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json @@ -7,9 +7,6 @@ }, "event": { "action": "opened", - "category": [ - "configuration" - ], "created": "2011-04-22T13:33:48.000Z", "kind": "event", "original": "{\"id\":1,\"node_id\":\"MDU6SXNzdWUx\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"number\":1347,\"state\":\"open\",\"title\":\"Found a bug\",\"body\":\"I'm having a problem with this.\",\"user\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":true},\"labels\":[{\"id\":208045946,\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\",\"name\":\"bug\",\"description\":\"Something isn't working\",\"color\":\"f29513\",\"default\":true}],\"assignee\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"assignees\":[{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false}],\"milestone\":{\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"id\":1002604,\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"state\":\"open\",\"title\":\"v1.0\",\"description\":\"Tracking milestone for version 1.0\",\"creator\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"open_issues\":4,\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"closed_at\":\"2013-02-12T13:22:01Z\",\"due_on\":\"2012-10-09T23:39:01Z\"},\"locked\":true,\"active_lock_reason\":\"too heated\",\"comments\":0,\"pull_request\":{\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\"},\"closed_at\":null,\"created_at\":\"2011-04-22T13:33:48Z\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"closed_by\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"repository\": {\"id\":1296269,\"node_id\":\"MDEwOlJlcG9zaXRvcnkxMjk2MjY5\",\"name\":\"Hello-World\",\"full_name\":\"octocat/Hello-World\",\"owner\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"private\":false,\"html_url\":\"https://github.com/octocat/Hello-World\",\"description\":\"This your first repo!\",\"fork\":false,\"url\":\"https://api.github.com/repos/octocat/Hello-World\",\"archive_url\":\"https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}\",\"assignees_url\":\"https://api.github.com/repos/octocat/Hello-World/assignees{/user}\",\"blobs_url\":\"https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}\",\"branches_url\":\"https://api.github.com/repos/octocat/Hello-World/branches{/branch}\",\"collaborators_url\":\"https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}\",\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/comments{/number}\",\"commits_url\":\"https://api.github.com/repos/octocat/Hello-World/commits{/sha}\",\"compare_url\":\"https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}\",\"contents_url\":\"https://api.github.com/repos/octocat/Hello-World/contents/{+path}\",\"contributors_url\":\"https://api.github.com/repos/octocat/Hello-World/contributors\",\"deployments_url\":\"https://api.github.com/repos/octocat/Hello-World/deployments\",\"downloads_url\":\"https://api.github.com/repos/octocat/Hello-World/downloads\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/events\",\"forks_url\":\"https://api.github.com/repos/octocat/Hello-World/forks\",\"git_commits_url\":\"https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}\",\"git_refs_url\":\"https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}\",\"git_tags_url\":\"https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}\",\"git_url\":\"git:github.com/octocat/Hello-World.git\",\"issue_comment_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}\",\"issue_events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/events{/number}\",\"issues_url\":\"https://api.github.com/repos/octocat/Hello-World/issues{/number}\",\"keys_url\":\"https://api.github.com/repos/octocat/Hello-World/keys{/key_id}\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/labels{/name}\",\"languages_url\":\"https://api.github.com/repos/octocat/Hello-World/languages\",\"merges_url\":\"https://api.github.com/repos/octocat/Hello-World/merges\",\"milestones_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones{/number}\",\"notifications_url\":\"https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}\",\"pulls_url\":\"https://api.github.com/repos/octocat/Hello-World/pulls{/number}\",\"releases_url\":\"https://api.github.com/repos/octocat/Hello-World/releases{/id}\",\"ssh_url\":\"git@github.com:octocat/Hello-World.git\",\"stargazers_url\":\"https://api.github.com/repos/octocat/Hello-World/stargazers\",\"statuses_url\":\"https://api.github.com/repos/octocat/Hello-World/statuses/{sha}\",\"subscribers_url\":\"https://api.github.com/repos/octocat/Hello-World/subscribers\",\"subscription_url\":\"https://api.github.com/repos/octocat/Hello-World/subscription\",\"tags_url\":\"https://api.github.com/repos/octocat/Hello-World/tags\",\"teams_url\":\"https://api.github.com/repos/octocat/Hello-World/teams\",\"trees_url\":\"https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}\",\"clone_url\":\"https://github.com/octocat/Hello-World.git\",\"mirror_url\":\"git:git.example.com/octocat/Hello-World\",\"hooks_url\":\"https://api.github.com/repos/octocat/Hello-World/hooks\",\"svn_url\":\"https://svn.github.com/octocat/Hello-World\",\"homepage\":\"https://github.com\",\"language\":null,\"forks_count\":9,\"stargazers_count\":80,\"watchers_count\":80,\"size\":108,\"default_branch\":\"master\",\"open_issues_count\":0,\"is_template\":true,\"topics\":[\"octocat\",\"atom\",\"electron\",\"api\"],\"has_issues\":true,\"has_projects\":true,\"has_wiki\":true,\"has_pages\":false,\"has_downloads\":true,\"archived\":false,\"disabled\":false,\"visibility\":\"public\",\"pushed_at\":\"2011-01-26T19:06:43Z\",\"created_at\":\"2011-01-26T19:01:12Z\",\"updated_at\":\"2011-01-26T19:14:43Z\",\"permissions\":{\"admin\":false,\"push\":false,\"pull\":true},\"allow_rebase_merge\":true,\"template_repository\":null,\"temp_clone_token\":\"ABTLWHOULUVAXGTRYU7OC2876QJ2O\",\"allow_squash_merge\":true,\"allow_auto_merge\":false,\"delete_branch_on_merge\":true,\"allow_merge_commit\":true,\"subscribers_count\":42,\"network_count\":0,\"license\":{\"key\":\"mit\",\"name\":\"MIT License\",\"url\":\"https://api.github.com/licenses/mit\",\"spdx_id\":\"MIT\",\"node_id\":\"MDc6TGljZW5zZW1pdA==\",\"html_url\":\"https://github.com/licenses/mit\"},\"forks\":1,\"open_issues\":1,\"watchers\":1},\"author_association\":\"COLLABORATOR\",\"state_reason\":\"completed\"}", @@ -119,9 +116,6 @@ }, "event": { "action": "opened", - "category": [ - "configuration" - ], "created": "2022-11-23T15:07:18.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4710\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/events\",\"html_url\":\"https://github.com/elastic/integrations/issues/4710\",\"id\":1461928292,\"node_id\":\"I_kwDODAw23M5XI0Fk\",\"number\":4710,\"title\":\"Custom STIX Package\",\"user\":{\"login\":\"jamiehynds\",\"id\":62879768,\"node_id\":\"MDQ6VXNlcjYyODc5NzY4\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/62879768?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/jamiehynds\",\"html_url\":\"https://github.com/jamiehynds\",\"followers_url\":\"https://api.github.com/users/jamiehynds/followers\",\"following_url\":\"https://api.github.com/users/jamiehynds/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/jamiehynds/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/jamiehynds/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/jamiehynds/subscriptions\",\"organizations_url\":\"https://api.github.com/users/jamiehynds/orgs\",\"repos_url\":\"https://api.github.com/users/jamiehynds/repos\",\"events_url\":\"https://api.github.com/users/jamiehynds/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/jamiehynds/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":3104073484,\"node_id\":\"MDU6TGFiZWwzMTA0MDczNDg0\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:Threat%20Intel\",\"name\":\"Integration:Threat Intel\",\"color\":\"ffffff\",\"default\":false,\"description\":\"\"}],\"state\":\"open\",\"locked\":false,\"assignee\":{\"login\":\"P1llus\",\"id\":8027539,\"node_id\":\"MDQ6VXNlcjgwMjc1Mzk=\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/8027539?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/P1llus\",\"html_url\":\"https://github.com/P1llus\",\"followers_url\":\"https://api.github.com/users/P1llus/followers\",\"following_url\":\"https://api.github.com/users/P1llus/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/P1llus/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/P1llus/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/P1llus/subscriptions\",\"organizations_url\":\"https://api.github.com/users/P1llus/orgs\",\"repos_url\":\"https://api.github.com/users/P1llus/repos\",\"events_url\":\"https://api.github.com/users/P1llus/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/P1llus/received_events\",\"type\":\"User\",\"site_admin\":false},\"assignees\":[{\"login\":\"P1llus\",\"id\":8027539,\"node_id\":\"MDQ6VXNlcjgwMjc1Mzk=\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/8027539?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/P1llus\",\"html_url\":\"https://github.com/P1llus\",\"followers_url\":\"https://api.github.com/users/P1llus/followers\",\"following_url\":\"https://api.github.com/users/P1llus/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/P1llus/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/P1llus/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/P1llus/subscriptions\",\"organizations_url\":\"https://api.github.com/users/P1llus/orgs\",\"repos_url\":\"https://api.github.com/users/P1llus/repos\",\"events_url\":\"https://api.github.com/users/P1llus/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/P1llus/received_events\",\"type\":\"User\",\"site_admin\":false}],\"milestone\":null,\"comments\":2,\"created_at\":\"2022-11-23T15:06:34Z\",\"updated_at\":\"2022-11-23T15:07:18Z\",\"closed_at\":null,\"author_association\":\"NONE\",\"active_lock_reason\":null,\"body\":\"Structured Threat Information Expression (STIX) is a language for expressing cyber threat and observable information. While we have several Threat Intel integrations which map STIX formatted data to Elastic Common Schema, users will always have need to ingest IOC's from threat feeds that we don't support out of the box. 'How do I ingest STIX feeds' remains a very common questions across community Slack, Discuss, Github, etc. A custom package would solve for this. \\r\\n\\r\\nTo allow for the broad range of STIX formatted feeds, we should provide a way for users to ingest data from ANY STIX feed, via a 'Custom STIX' package. The package will leverage our httpjson input under the hood, but include an ingest pipeline which maps STIX fields to ECS (we expect there'll still be a need for custom fields, as not all STIX fields have a corresponding field in ECS). \\r\\n\\r\\nThere may be cases where some feeds/vendors don't strictly conform to STIX, and in those cases, users may have to modify our pipeline and that's ok. We'll focus on correctly formatted STIX data. \",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4710/timeline\",\"performed_via_github_app\":null,\"state_reason\":null}", @@ -217,9 +211,6 @@ }, "event": { "action": "opened", - "category": [ - "configuration" - ], "created": "2022-11-23T14:58:03.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4707\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/events\",\"html_url\":\"https://github.com/elastic/integrations/issues/4707\",\"id\":1461726255,\"node_id\":\"I_kwDODAw23M5XICwv\",\"number\":4707,\"title\":\"[ Crowdstrike Falcon ] Parse of process field is wrong.\",\"user\":{\"login\":\"leandrojmp\",\"id\":322886,\"node_id\":\"MDQ6VXNlcjMyMjg4Ng==\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/322886?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/leandrojmp\",\"html_url\":\"https://github.com/leandrojmp\",\"followers_url\":\"https://api.github.com/users/leandrojmp/followers\",\"following_url\":\"https://api.github.com/users/leandrojmp/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/leandrojmp/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/leandrojmp/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/leandrojmp/subscriptions\",\"organizations_url\":\"https://api.github.com/users/leandrojmp/orgs\",\"repos_url\":\"https://api.github.com/users/leandrojmp/repos\",\"events_url\":\"https://api.github.com/users/leandrojmp/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/leandrojmp/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":2716642190,\"node_id\":\"MDU6TGFiZWwyNzE2NjQyMTkw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:Crowdstrike\",\"name\":\"Integration:Crowdstrike\",\"color\":\"FFFFFF\",\"default\":false,\"description\":null}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":1,\"created_at\":\"2022-11-23T13:03:54Z\",\"updated_at\":\"2022-11-23T14:58:03Z\",\"closed_at\":null,\"author_association\":\"NONE\",\"active_lock_reason\":null,\"body\":\"Hello,\\r\\n\\r\\nThe parse of the process fields in the Crowdstrike Falcon Pipeline is wrong, it is creating fields with dots in the name instead of nested json objects.\\r\\n\\r\\nIt creates this:\\r\\n```\\r\\n{\\r\\n \\\"process.executable\\\": \\\"value\\\"\\r\\n}\\r\\n```\\r\\n\\r\\nInstead of\\r\\n\\r\\n```\\r\\n{\\r\\n \\\"process\\\": {\\r\\n \\\"executable\\\": \\\"value\\\"\\r\\n }\\r\\n}\\r\\n```\\r\\n\\r\\nThis same issue was present in the [filebeat integration](https://github.com/elastic/beats/issues/27622) and I submitted a [fix](https://github.com/elastic/beats/pull/27623) more than an year ago.\\r\\n\\r\\nI will submit a PR later with the same fix, but I'm creating this issue to register the problem.\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4707/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", @@ -296,9 +287,6 @@ }, "event": { "action": "opened", - "category": [ - "configuration" - ], "created": "2022-11-23T11:15:48.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4704\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/events\",\"html_url\":\"https://github.com/elastic/integrations/pull/4704\",\"id\":1461524465,\"node_id\":\"PR_kwDODAw23M5DjMOh\",\"number\":4704,\"title\":\"[Enhancement] [Infoblox Bloxone DDI] Update the Pagination Termination Condition and Added Filter instead of KQL in visualizations\",\"user\":{\"login\":\"vinit-elastic\",\"id\":89848047,\"node_id\":\"MDQ6VXNlcjg5ODQ4MDQ3\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/89848047?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/vinit-elastic\",\"html_url\":\"https://github.com/vinit-elastic\",\"followers_url\":\"https://api.github.com/users/vinit-elastic/followers\",\"following_url\":\"https://api.github.com/users/vinit-elastic/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/vinit-elastic/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/vinit-elastic/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/vinit-elastic/subscriptions\",\"organizations_url\":\"https://api.github.com/users/vinit-elastic/orgs\",\"repos_url\":\"https://api.github.com/users/vinit-elastic/repos\",\"events_url\":\"https://api.github.com/users/vinit-elastic/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/vinit-elastic/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":1498531540,\"node_id\":\"MDU6TGFiZWwxNDk4NTMxNTQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/enhancement\",\"name\":\"enhancement\",\"color\":\"a2eeef\",\"default\":true,\"description\":\"New feature or request\"},{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":4528694847,\"node_id\":\"LA_kwDODAw23M8AAAABDe5mPw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:infoblox_bloxone_ddi\",\"name\":\"Integration:infoblox_bloxone_ddi\",\"color\":\"FFFFFF\",\"default\":false,\"description\":\"Infoblox BloxOne DDI (DNS, DHCP, IP management)\"}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":4,\"created_at\":\"2022-11-23T10:57:54Z\",\"updated_at\":\"2022-11-23T11:15:48Z\",\"closed_at\":null,\"author_association\":\"COLLABORATOR\",\"active_lock_reason\":null,\"draft\":false,\"pull_request\":{\"url\":\"https://api.github.com/repos/elastic/integrations/pulls/4704\",\"html_url\":\"https://github.com/elastic/integrations/pull/4704\",\"diff_url\":\"https://github.com/elastic/integrations/pull/4704.diff\",\"patch_url\":\"https://github.com/elastic/integrations/pull/4704.patch\",\"merged_at\":null},\"body\":\" Type of change\\r\\n- Enhancement\\r\\n\\r\\n\\r\\n## What does this PR do?\\r\\nUpdate the Pagination Termination Condition for Infoblox Bloxone DDI connector.\\r\\n\\r\\nCurrent condition for pagination termination contains `[[else]][[.last_response.terminate_pagination]][[end]]` which results in error logs when pagination is completed.\\r\\n\\r\\nRemoving this `else` condition will not result in error logs.\\r\\n\\r\\n\\r\\n\\r\\n## Checklist\\r\\n\\r\\n- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.\\r\\n- [x] I have verified that all data streams collect metrics or logs.\\r\\n- [x] I have added an entry to my package's `changelog.yml` file.\\r\\n- [x] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).\\r\\n\\r\\n\\r\\n\\r\\n## How to test this PR locally\\r\\n- Clone integrations repo.\\r\\n- Install elastic package locally.\\r\\n- Start elastic stack using elastic-package.\\r\\n- Move to integrations/packages/infoblox_bloxone_ddi directory.\\r\\n- Run the following command to run tests. \\r\\n> elastic-package test \\r\\n\\r\\n\\r\\n## Related issues\\r\\n\\r\\n\\r\\n- Relates https://github.com/elastic/integrations/issues/4527\\r\\n\\r\\n## Screenshots\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529720-18c110cd-5343-4d70-bbfb-eed0b81313af.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529765-4b183071-6ed9-4bc8-8a98-fd04955bb4d7.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529819-78128d98-630e-49e5-bf97-f86059c0cc26.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203529936-df7e3d6f-031e-4b0c-992f-93707a507735.png)\\r\\n\\r\\n\\r\\n\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4704/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", @@ -387,9 +375,6 @@ }, "event": { "action": "opened", - "category": [ - "configuration" - ], "created": "2022-11-23T11:23:56.000Z", "kind": "event", "original": "{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4703\",\"repository_url\":\"https://api.github.com/repos/elastic/integrations\",\"labels_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/comments\",\"events_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/events\",\"html_url\":\"https://github.com/elastic/integrations/pull/4703\",\"id\":1461503410,\"node_id\":\"PR_kwDODAw23M5DjHjk\",\"number\":4703,\"title\":\"[Enhancement] [AWS Security Hub] Update the Pagination Termination Condition\",\"user\":{\"login\":\"vinit-elastic\",\"id\":89848047,\"node_id\":\"MDQ6VXNlcjg5ODQ4MDQ3\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/89848047?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/vinit-elastic\",\"html_url\":\"https://github.com/vinit-elastic\",\"followers_url\":\"https://api.github.com/users/vinit-elastic/followers\",\"following_url\":\"https://api.github.com/users/vinit-elastic/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/vinit-elastic/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/vinit-elastic/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/vinit-elastic/subscriptions\",\"organizations_url\":\"https://api.github.com/users/vinit-elastic/orgs\",\"repos_url\":\"https://api.github.com/users/vinit-elastic/repos\",\"events_url\":\"https://api.github.com/users/vinit-elastic/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/vinit-elastic/received_events\",\"type\":\"User\",\"site_admin\":false},\"labels\":[{\"id\":1498531540,\"node_id\":\"MDU6TGFiZWwxNDk4NTMxNTQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/enhancement\",\"name\":\"enhancement\",\"color\":\"a2eeef\",\"default\":true,\"description\":\"New feature or request\"},{\"id\":2404921703,\"node_id\":\"MDU6TGFiZWwyNDA0OTIxNzAz\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Team:Security-Service%20Integrations\",\"name\":\"Team:Security-Service Integrations\",\"color\":\"1d76db\",\"default\":false,\"description\":\"Label for the Security External Integrations team\"},{\"id\":2607750240,\"node_id\":\"MDU6TGFiZWwyNjA3NzUwMjQw\",\"url\":\"https://api.github.com/repos/elastic/integrations/labels/Integration:AWS\",\"name\":\"Integration:AWS\",\"color\":\"FFFFFF\",\"default\":false,\"description\":\"\"}],\"state\":\"open\",\"locked\":false,\"assignee\":null,\"assignees\":[],\"milestone\":null,\"comments\":4,\"created_at\":\"2022-11-23T10:44:59Z\",\"updated_at\":\"2022-11-23T11:23:56Z\",\"closed_at\":null,\"author_association\":\"COLLABORATOR\",\"active_lock_reason\":null,\"draft\":false,\"pull_request\":{\"url\":\"https://api.github.com/repos/elastic/integrations/pulls/4703\",\"html_url\":\"https://github.com/elastic/integrations/pull/4703\",\"diff_url\":\"https://github.com/elastic/integrations/pull/4703.diff\",\"patch_url\":\"https://github.com/elastic/integrations/pull/4703.patch\",\"merged_at\":null},\"body\":\" Type of change\\r\\n- Enhancement\\r\\n\\r\\n\\r\\n## What does this PR do?\\r\\nUpdate the Pagination Termination Condition for AWS Security Hub connector.\\r\\n\\r\\nCurrent condition for pagination termination contains `[[else]][[.last_response.terminate_pagination]][[end]]` which results in error logs when pagination is completed.\\r\\n\\r\\nRemoving this `else` condition will not result in error logs.\\r\\n\\r\\n\\r\\n\\r\\n## Checklist\\r\\n\\r\\n- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.\\r\\n- [x] I have verified that all data streams collect metrics or logs.\\r\\n- [x] I have added an entry to my package's `changelog.yml` file.\\r\\n- [x] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).\\r\\n\\r\\n\\r\\n\\r\\n## How to test this PR locally\\r\\n- Clone integrations repo.\\r\\n- Install elastic package locally.\\r\\n- Start elastic stack using elastic-package.\\r\\n- Move to integrations/packages/aws directory.\\r\\n- Run the following command to run tests. \\r\\n> elastic-package test \\r\\n\\r\\n\\r\\n## Related issues\\r\\n\\r\\n\\r\\n- Relates https://github.com/elastic/integrations/issues/4527\\r\\n\\r\\n## Screenshots\\r\\n![image](https://user-images.githubusercontent.com/89848047/203526900-06519c95-3de5-4f88-a65d-555d03d7f9a1.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203527000-b050f059-03c6-4ead-a88e-9f2e42efb537.png)\\r\\n![image](https://user-images.githubusercontent.com/89848047/203527123-ea1f8513-8371-4d06-8a17-b71c0dae7a5a.png)\\r\\n\\r\\n\\r\\n\",\"reactions\":{\"url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/reactions\",\"total_count\":0,\"+1\":0,\"-1\":0,\"laugh\":0,\"hooray\":0,\"confused\":0,\"heart\":0,\"rocket\":0,\"eyes\":0},\"timeline_url\":\"https://api.github.com/repos/elastic/integrations/issues/4703/timeline\",\"performed_via_github_app\":null,\"state_reason\":null }", diff --git a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml index 1a9cfe49953..d9b9e2bdc6b 100644 --- a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml @@ -26,10 +26,6 @@ processors: - set: field: event.kind value: event - - append: - field: event.category - value: configuration - tag: append_configuration_into_event_category # The API returns a snapshot of the issue's current state, not a discrete action, so # event.type is inferred from timestamps. `creation` applies only while the issue has # never been modified; reopened and closed issues have updated_at > created_at. diff --git a/packages/github/data_stream/issues/sample_event.json b/packages/github/data_stream/issues/sample_event.json index 848e1e5ad61..0ea4abee71c 100644 --- a/packages/github/data_stream/issues/sample_event.json +++ b/packages/github/data_stream/issues/sample_event.json @@ -1,34 +1,31 @@ { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "d8a50fcb-cdf2-4d73-8a4a-cb5a2812f250", - "id": "a9884168-c5a2-4d45-b7a8-cca26df090d2", - "name": "elastic-agent-96514", + "ephemeral_id": "0aa2f45d-e0a7-421c-ade5-45aa21712041", + "id": "906bbf2a-d522-4c69-829f-8d0d4d615392", + "name": "elastic-agent-18769", "type": "filebeat", "version": "8.19.10" }, "data_stream": { "dataset": "github.issues", - "namespace": "70003", + "namespace": "88899", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "a9884168-c5a2-4d45-b7a8-cca26df090d2", + "id": "906bbf2a-d522-4c69-829f-8d0d4d615392", "snapshot": false, "version": "8.19.10" }, "event": { "action": "opened", "agent_id_status": "verified", - "category": [ - "configuration" - ], "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2026-07-26T14:44:15Z", + "ingested": "2026-07-29T03:53:27Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", "type": [ diff --git a/packages/github/docs/README.md b/packages/github/docs/README.md index 7258034bffd..f47b7549e6c 100644 --- a/packages/github/docs/README.md +++ b/packages/github/docs/README.md @@ -957,34 +957,31 @@ An example event for `issues` looks as following: { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "d8a50fcb-cdf2-4d73-8a4a-cb5a2812f250", - "id": "a9884168-c5a2-4d45-b7a8-cca26df090d2", - "name": "elastic-agent-96514", + "ephemeral_id": "0aa2f45d-e0a7-421c-ade5-45aa21712041", + "id": "906bbf2a-d522-4c69-829f-8d0d4d615392", + "name": "elastic-agent-18769", "type": "filebeat", "version": "8.19.10" }, "data_stream": { "dataset": "github.issues", - "namespace": "70003", + "namespace": "88899", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "a9884168-c5a2-4d45-b7a8-cca26df090d2", + "id": "906bbf2a-d522-4c69-829f-8d0d4d615392", "snapshot": false, "version": "8.19.10" }, "event": { "action": "opened", "agent_id_status": "verified", - "category": [ - "configuration" - ], "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2026-07-26T14:44:15Z", + "ingested": "2026-07-29T03:53:27Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", "type": [ diff --git a/packages/google_workspace/data_stream/calendar/_dev/test/pipeline/test-calendar.log-expected.json b/packages/google_workspace/data_stream/calendar/_dev/test/pipeline/test-calendar.log-expected.json index ff3814b1072..a1f6eec217f 100644 --- a/packages/google_workspace/data_stream/calendar/_dev/test/pipeline/test-calendar.log-expected.json +++ b/packages/google_workspace/data_stream/calendar/_dev/test/pipeline/test-calendar.log-expected.json @@ -320,9 +320,6 @@ }, "event": { "action": "print-preview-event", - "category": [ - "configuration" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-04-01T07:13:18.495Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"calendar\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"ownerDomain\": \"elastic.com\", \"ipAddress\": \"67.43.156.13\", \"events\": {\"type\": \"event_change\", \"name\": \"print_preview_event\", \"parameters\": [{\"name\": \"event_id\", \"value\": \"abc123\"}, {\"name\": \"calendar_id\", \"value\": \"foo@bar.com\"}, {\"name\": \"event_title\", \"value\": \"Test Event\"}, {\"name\": \"recurring\", \"value\": \"no\"}, {\"name\": \"client_side_encrypted\", \"value\": \"no\"}, {\"name\": \"api_kind\", \"value\": \"web\"}, {\"name\": \"user_agent\", \"value\": \"Mozilla/5.0\"}]}}", @@ -1550,9 +1547,6 @@ }, "event": { "action": "export-calendar", - "category": [ - "configuration" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-04-01T06:58:04.206Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"calendar\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"ownerDomain\": \"elastic.com\", \"ipAddress\": \"67.43.156.13\", \"events\": {\"type\": \"calendar_change\", \"name\": \"export_calendar\", \"parameters\": [{\"name\": \"calendar_id\", \"value\": \"c_abc123@group.calendar.google.com\"}, {\"name\": \"api_kind\", \"value\": \"web\"}, {\"name\": \"user_agent\", \"value\": \"Mozilla/5.0\"}]}}", @@ -2116,9 +2110,6 @@ }, "event": { "action": "interop-freebusy-lookup-outbound-successful", - "category": [ - "configuration" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-28T07:41:12.671Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"calendar\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"ownerDomain\": \"elastic.com\", \"events\": {\"type\": \"interop\", \"name\": \"interop_freebusy_lookup_outbound_successful\", \"parameters\": [{\"name\": \"api_kind\", \"value\": \"web\"}, {\"name\": \"calendar_id\", \"value\": \"foo@bar.com\"}, {\"name\": \"remote_ews_url\", \"value\": \"https://exchange.example.com/EWS/Exchange.asmx\"}, {\"name\": \"requested_period_start\", \"intValue\": \"1743748267\"}, {\"name\": \"requested_period_end\", \"intValue\": \"1743748267\"}]}}", diff --git a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml index f1184ca3884..cce724a1bf0 100644 --- a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml @@ -108,9 +108,7 @@ processors: create_calendar: configuration delete_calendar: configuration change_calendar_description: configuration - export_calendar: configuration change_calendar_location: configuration - print_preview_calendar: configuration change_calendar_timezone: configuration change_calendar_title: configuration add_subscription: configuration @@ -122,29 +120,23 @@ processors: delete_event: configuration add_event_guest: configuration change_event_guest_response_auto: configuration - remove_event_guest: configuration + remove_event_guest: configuration change_event_guest_response: configuration change_event: configuration - print_preview_event: configuration remove_event_from_trash: configuration restore_event: configuration change_event_start_time: configuration - change_event_title: configuration + change_event_title: configuration transfer_event_completed: configuration transfer_event_requested: configuration - interop_freebusy_lookup_outbound_successful: configuration - interop_freebusy_lookup_inbound_successful: configuration - interop_exchange_resource_availability_lookup_successful: configuration - interop_exchange_resource_list_lookup_successful: configuration - interop_freebusy_lookup_outbound_unsuccessful: configuration - interop_freebusy_lookup_inbound_unsuccessful: configuration - interop_exchange_resource_availability_lookup_unsuccessful: configuration - interop_exchange_resource_list_lookup_unsuccessful: configuration source: |- ctx.event = ctx.event ?: [:]; - def category = []; - category.add(params.get(ctx.google_workspace.calendar.name)); - ctx.event.category = category; + def category = params.get(ctx.google_workspace.calendar.name); + if (category == null) { + ctx.event.remove('category'); + } else { + ctx.event.category = [category]; + } on_failure: - append: field: error.message @@ -162,7 +154,7 @@ processors: change_calendar_description: change export_calendar: info change_calendar_location: change - print_preview_calendar: info + print_preview_calendar: info change_calendar_timezone: change change_calendar_title: change notification_triggered: info @@ -175,24 +167,24 @@ processors: delete_event: deletion add_event_guest: change change_event_guest_response_auto: change - remove_event_guest: change + remove_event_guest: change change_event_guest_response: change change_event: change print_preview_event: info remove_event_from_trash: change restore_event: change change_event_start_time: change - change_event_title: change + change_event_title: change transfer_event_completed: change transfer_event_requested: info interop_freebusy_lookup_outbound_successful: info - interop_freebusy_lookup_inbound_successful: info + interop_freebusy_lookup_inbound_successful: info interop_exchange_resource_availability_lookup_successful: info interop_exchange_resource_list_lookup_successful: info interop_freebusy_lookup_outbound_unsuccessful: info interop_freebusy_lookup_inbound_unsuccessful: info - interop_exchange_resource_availability_lookup_unsuccessful: info - interop_exchange_resource_list_lookup_unsuccessful: info + interop_exchange_resource_availability_lookup_unsuccessful: info + interop_exchange_resource_list_lookup_unsuccessful: info source: |- ctx.event = ctx.event ?: [:]; def type = []; diff --git a/packages/google_workspace/data_stream/calendar/sample_event.json b/packages/google_workspace/data_stream/calendar/sample_event.json index 140d84b3af9..cbe9b70be22 100644 --- a/packages/google_workspace/data_stream/calendar/sample_event.json +++ b/packages/google_workspace/data_stream/calendar/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2025-04-01T07:00:40.262Z", "agent": { - "ephemeral_id": "bff7fec7-4d40-45ad-be16-632427fab559", - "id": "b3774315-d26c-4bf5-9778-d470566fab35", - "name": "elastic-agent-85176", + "ephemeral_id": "833853f9-febd-4424-916d-902130ddaf9e", + "id": "c5aebc7f-a471-46b7-82c5-b172b336f7da", + "name": "elastic-agent-84379", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.calendar", - "namespace": "40687", + "namespace": "15097", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "b3774315-d26c-4bf5-9778-d470566fab35", + "id": "c5aebc7f-a471-46b7-82c5-b172b336f7da", "snapshot": false, "version": "8.19.4" }, @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.calendar", "id": "1", - "ingested": "2026-07-22T07:07:30Z", + "ingested": "2026-07-29T04:07:36Z", "kind": "event", "original": "{\"actor\":{\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"delete_calendar\",\"parameters\":[{\"name\":\"calendar_id\",\"value\":\"c_abc123@group.calendar.google.com\"},{\"name\":\"api_kind\",\"value\":\"web\"},{\"name\":\"user_agent\",\"value\":\"Mozilla/5.0\"}],\"type\":\"calendar_change\"},\"id\":{\"applicationName\":\"calendar\",\"customerId\":\"1\",\"time\":\"2025-04-01T07:00:40.262Z\",\"uniqueQualifier\":\"1\"},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "calendar", diff --git a/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json b/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json index 98ca480bde2..a355b4bc848 100644 --- a/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json +++ b/packages/google_workspace/data_stream/chat/_dev/test/pipeline/test-chat.log-expected.json @@ -239,9 +239,6 @@ }, "event": { "action": "invite-accept", - "category": [ - "configuration" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-26T05:53:45.936Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"chat\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"invite_accept\", \"parameters\": [{\"name\": \"room_id\", \"value\": \"1\"}, {\"name\": \"actor\", \"value\": \"foo@bar.com\"}, {\"name\": \"room_name\", \"value\": \"TEST 2\"}, {\"name\": \"external_room\", \"value\": \"DISABLED\"}, {\"name\": \"actor_type\", \"value\": \"NON_ADMIN\"}, {\"name\": \"conversation_type\", \"value\": \"SPACE\"}, {\"name\": \"conversation_ownership\", \"value\": \"INTERNALLY_OWNED\"}]}}", @@ -615,9 +612,6 @@ }, "event": { "action": "custom-status-updated", - "category": [ - "configuration" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-26T05:44:13.080Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"chat\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"user_action\", \"name\": \"custom_status_updated\", \"parameters\": [{\"name\": \"actor\", \"value\": \"foo@bar.com\"}, {\"name\": \"actor_type\", \"value\": \"NON_ADMIN\"}]}}", diff --git a/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml index 427f6cd2f5f..09ea0b1e879 100644 --- a/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml @@ -111,14 +111,10 @@ processors: attachment_upload: file block_room: configuration block_user: configuration - custom_status_updated: configuration emoji_created: configuration emoji_deleted: configuration history_turned_off: configuration history_turned_on: configuration - invite_accept: configuration - invite_decline: configuration - invite_send: configuration remove_room_member: configuration room_created: configuration room_deleted: configuration @@ -131,9 +127,12 @@ processors: role_updated: iam source: |- ctx.event = ctx.event ?: [:]; - def category = []; - category.add(params.get(ctx.google_workspace.chat.name)); - ctx.event.category = category; + def category = params.get(ctx.google_workspace.chat.name); + if (category == null) { + ctx.event.remove('category'); + } else { + ctx.event.category = [category]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/chat/sample_event.json b/packages/google_workspace/data_stream/chat/sample_event.json index a42db29b837..9c1f8775a88 100644 --- a/packages/google_workspace/data_stream/chat/sample_event.json +++ b/packages/google_workspace/data_stream/chat/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2025-03-26T05:55:02.063Z", "agent": { - "ephemeral_id": "6449a9b1-d610-4094-960a-4e43c2c87006", - "id": "13ad2886-85c9-43e5-8293-9bd32dbf1657", - "name": "elastic-agent-40045", + "ephemeral_id": "63e3d48f-55f0-4329-97a7-ccb77d539f2a", + "id": "8f3a240d-a025-4cfc-a3d2-0569d269a1fe", + "name": "elastic-agent-60488", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chat", - "namespace": "80821", + "namespace": "13343", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "13ad2886-85c9-43e5-8293-9bd32dbf1657", + "id": "8f3a240d-a025-4cfc-a3d2-0569d269a1fe", "snapshot": false, "version": "8.19.4" }, @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.chat", "id": "1", - "ingested": "2026-07-22T06:53:39Z", + "ingested": "2026-07-29T04:08:34Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\",\"events\":{\"name\":\"room_name_updated\",\"parameters\":[{\"name\":\"room_id\",\"value\":\"1\"},{\"name\":\"actor\",\"value\":\"foo@bar.com\"},{\"name\":\"room_name\",\"value\":\"TEST3\"},{\"name\":\"external_room\",\"value\":\"DISABLED\"},{\"name\":\"actor_type\",\"value\":\"NON_ADMIN\"},{\"name\":\"conversation_type\",\"value\":\"SPACE\"},{\"name\":\"conversation_ownership\",\"value\":\"INTERNALLY_OWNED\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"chat\",\"customerId\":\"1\",\"time\":\"2025-03-26T05:55:02.063Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "chat", diff --git a/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml index 376ac921671..0d958965def 100644 --- a/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml @@ -142,16 +142,18 @@ processors: extension_request: configuration login_event: authentication malware_transfer: malware - password_breach: authentication sensitive_data_transfer: file unsafe_site_visit: web source: |- if (ctx.event == null) { ctx.event = new HashMap(); } - def category = new ArrayList(); - category.add(params.get(ctx.google_workspace.chrome.name.toLowerCase())); - ctx.event.put('category', category); + def category = params.get(ctx.google_workspace.chrome.name.toLowerCase()); + if (category == null) { + ctx.event.remove('category'); + } else { + ctx.event.put('category', [category]); + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/chrome/sample_event.json b/packages/google_workspace/data_stream/chrome/sample_event.json index 9974987e809..3391ee4a2b7 100644 --- a/packages/google_workspace/data_stream/chrome/sample_event.json +++ b/packages/google_workspace/data_stream/chrome/sample_event.json @@ -1,15 +1,15 @@ { "@timestamp": "2024-12-09T14:18:25.405Z", "agent": { - "ephemeral_id": "2b7f7f2f-6c69-4d6b-8edd-948ca3c6f110", - "id": "21d74789-d99d-4dfe-af4a-2288b3a564de", - "name": "elastic-agent-48415", + "ephemeral_id": "badc7085-7c02-4c86-b76e-394e9ca1d669", + "id": "e361e869-51a3-4e11-9525-c96595319143", + "name": "elastic-agent-34701", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chrome", - "namespace": "80177", + "namespace": "37207", "type": "logs" }, "device": { @@ -21,7 +21,7 @@ "version": "8.16.0" }, "elastic_agent": { - "id": "21d74789-d99d-4dfe-af4a-2288b3a564de", + "id": "e361e869-51a3-4e11-9525-c96595319143", "snapshot": false, "version": "8.19.4" }, @@ -33,7 +33,7 @@ ], "dataset": "google_workspace.chrome", "id": "-3640711002716937498", - "ingested": "2026-07-22T06:55:21Z", + "ingested": "2026-07-29T04:09:32Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh.kumar@example.io\",\"profileId\":\"109689693170624712102\"},\"etag\":\"\\\"CfV-pEPVZc7PJf2fWsHJTliD34MdGbO8iFIk3L4uBwQ/cBsNSJx2A9Lg8kiQCGLddmq827A\\\"\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"lmjegmlicamnimmfhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"02gajno12larrqx\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", diff --git a/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json b/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json index d8caeec09df..f66a33a013e 100644 --- a/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json +++ b/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json @@ -186,7 +186,6 @@ "original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"example.com\",\"ipAddress\":\"67.43.156.13\",\"etag\":\"string\",\"events\":{\"type\":\"device_updates\",\"name\":\"DEVICE_SYNC_EVENT\",\"parameters\":[{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"LAST_SYNC_AUDIT_DATE\",\"value\":\"1731689445476\"}]}}", "provider": "login", "type": [ - "change", "info" ] }, diff --git a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml index f783de69787..51012251b48 100644 --- a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml @@ -552,7 +552,7 @@ processors: field: event.category tag: append_malware_into_event_category value: malware - if: ctx.event?.action != null && ["SUSPICIOUS_ACTIVITY_EVENT", "APPLICATION_REPORT_EVENT"].contains(ctx.event.action) + if: ctx.event?.action != null && ctx.event.action == "SUSPICIOUS_ACTIVITY_EVENT" - append: field: event.category tag: append_threat_into_event_category @@ -567,7 +567,7 @@ processors: field: event.type tag: append_change_into_event_type value: change - if: ctx.event?.action != null && ["APPLICATION_EVENT", "DEVICE_ACTION_EVENT", "DEVICE_COMPLIANCE_CHANGED_EVENT", "OS_UPDATED_EVENT", "DEVICE_OWNERSHIP_CHANGE_EVENT", "DEVICE_SETTINGS_UPDATED_EVENT", "ADVANCED_POLICY_SYNC_EVENT", "RISK_SIGNAL_UPDATED_EVENT", "ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT", "APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT", "DEVICE_SYNC_EVENT"].contains(ctx.event.action) + if: ctx.event?.action != null && ["APPLICATION_EVENT", "DEVICE_ACTION_EVENT", "DEVICE_COMPLIANCE_CHANGED_EVENT", "OS_UPDATED_EVENT", "DEVICE_OWNERSHIP_CHANGE_EVENT", "DEVICE_SETTINGS_UPDATED_EVENT", "ADVANCED_POLICY_SYNC_EVENT", "RISK_SIGNAL_UPDATED_EVENT", "ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT", "APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT"].contains(ctx.event.action) - append: field: event.type tag: append_info_into_event_type diff --git a/packages/google_workspace/data_stream/device/sample_event.json b/packages/google_workspace/data_stream/device/sample_event.json index ad734b650dd..80efcf74871 100644 --- a/packages/google_workspace/data_stream/device/sample_event.json +++ b/packages/google_workspace/data_stream/device/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "fa7c7a33-e988-49e4-81ec-a86495301da8", - "id": "0092765f-1d94-4789-973f-de5714762cd5", - "name": "elastic-agent-50116", + "ephemeral_id": "cf7859d2-bcd3-4e91-9434-5af0f3d3f6bc", + "id": "af766712-5402-4b83-931f-6d151f49defa", + "name": "elastic-agent-99347", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.device", - "namespace": "12815", + "namespace": "35081", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "0092765f-1d94-4789-973f-de5714762cd5", + "id": "af766712-5402-4b83-931f-6d151f49defa", "snapshot": false, "version": "8.19.4" }, @@ -27,10 +27,10 @@ "host", "package" ], - "created": "2026-07-22T06:57:43.273Z", + "created": "2026-07-29T04:10:28.571Z", "dataset": "google_workspace.device", "id": "1", - "ingested": "2026-07-22T06:57:46Z", + "ingested": "2026-07-29T04:10:31Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "outcome": "failure", diff --git a/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml index 47f3f1142e6..1008fb3553b 100644 --- a/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml @@ -215,7 +215,7 @@ processors: field: event.type tag: append_info_into_event_type value: info - if: ctx.event?.action != null && ["accept_invitation", "request_to_join", "reject_invitation", "reject_join_request", "revoke_invitation", "invite_member", "ban_member_with_moderation"].contains(ctx.event.action) + if: ctx.event?.action != null && ["accept_invitation", "request_to_join", "reject_invitation", "reject_join_request", "ban_member_with_moderation"].contains(ctx.event.action) - append: field: event.type tag: append_user_into_event_type diff --git a/packages/google_workspace/data_stream/group_enterprise/sample_event.json b/packages/google_workspace/data_stream/group_enterprise/sample_event.json index e54bd5dde64..ff24d2ec6ab 100644 --- a/packages/google_workspace/data_stream/group_enterprise/sample_event.json +++ b/packages/google_workspace/data_stream/group_enterprise/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "6a987c97-d057-4150-91e1-a2bd50c5e6da", - "id": "18b072b8-ac88-483c-a90d-49c240a62c32", - "name": "elastic-agent-95571", + "ephemeral_id": "679861d5-ade4-46b9-9625-bee639c322dd", + "id": "2e034b60-759e-4978-b9d0-314065ff8fd8", + "name": "elastic-agent-96066", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.group_enterprise", - "namespace": "54811", + "namespace": "61974", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "18b072b8-ac88-483c-a90d-49c240a62c32", + "id": "2e034b60-759e-4978-b9d0-314065ff8fd8", "snapshot": false, "version": "8.19.4" }, @@ -27,10 +27,10 @@ "iam", "configuration" ], - "created": "2026-07-22T06:59:56.725Z", + "created": "2026-07-29T04:11:31.741Z", "dataset": "google_workspace.group_enterprise", "id": "1", - "ingested": "2026-07-22T06:59:59Z", + "ingested": "2026-07-29T04:11:34Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}],\"type\":\"moderator_action\"},\"id\":{\"applicationName\":\"group_enterprise\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "provider": "group_enterprise", diff --git a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml index 423f2779089..a09b03f28e8 100644 --- a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml @@ -192,7 +192,7 @@ processors: - append: field: event.type value: info - if: '["2sv_disable","2sv_enroll","suspicious_login","suspicious_login_less_secure_app","suspicious_programmatic_login","titanium_enroll","titanium_unenroll","blocked_sender","email_forwarding_out_of_domain","login_challenge","login_verification","risky_sensitive_action_allowed","risky_sensitive_action_blocked","account_disabled_password_leak","passkey_enrolled","passkey_removed"].contains(ctx?.event?.action)' + if: '["2sv_disable","2sv_enroll","suspicious_login","suspicious_login_less_secure_app","suspicious_programmatic_login","titanium_enroll","titanium_unenroll","blocked_sender","email_forwarding_out_of_domain","login_challenge","login_verification","risky_sensitive_action_allowed","risky_sensitive_action_blocked","account_disabled_password_leak"].contains(ctx?.event?.action)' - set: field: event.kind value: alert diff --git a/packages/google_workspace/data_stream/login/sample_event.json b/packages/google_workspace/data_stream/login/sample_event.json index fa3f849e2f2..f35de628d27 100644 --- a/packages/google_workspace/data_stream/login/sample_event.json +++ b/packages/google_workspace/data_stream/login/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2022-05-04T15:04:05.000Z", "agent": { - "ephemeral_id": "8c93a4fd-7826-41c7-93c5-049492fbb595", - "id": "a1cb9595-5cce-49de-b682-888fdfb0238e", - "name": "elastic-agent-11695", + "ephemeral_id": "e4048d3d-afb8-4c10-adc4-95dcd300b19e", + "id": "80a855c8-f052-4ef6-b0ca-053ae021cfa2", + "name": "elastic-agent-55461", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.login", - "namespace": "40160", + "namespace": "86206", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "a1cb9595-5cce-49de-b682-888fdfb0238e", + "id": "80a855c8-f052-4ef6-b0ca-053ae021cfa2", "snapshot": false, "version": "8.19.4" }, @@ -26,10 +26,10 @@ "category": [ "iam" ], - "created": "2026-07-22T07:02:04.442Z", + "created": "2026-07-29T04:12:29.868Z", "dataset": "google_workspace.login", "id": "1", - "ingested": "2026-07-22T07:02:07Z", + "ingested": "2026-07-29T04:12:32Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "login", diff --git a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml index b5a370ec7f2..8c255aebd17 100644 --- a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml @@ -509,11 +509,6 @@ processors: tag: append_intrusion_detection_into_event_category_for_rule_events value: intrusion_detection if: ctx.event?.action != null && ["rule_match","rule_trigger","action_complete"].contains(ctx.event.action) - - append: - field: event.category - tag: append_configuration_into_event_category_for_label_events - value: configuration - if: ctx.event?.action != null && ["label_applied","label_field_value_changed","label_removed"].contains(ctx.event.action) - append: field: event.type tag: append_info_into_event_type_for_rule_events diff --git a/packages/google_workspace/data_stream/rules/sample_event.json b/packages/google_workspace/data_stream/rules/sample_event.json index 49214df1a8e..2f7a22c061f 100644 --- a/packages/google_workspace/data_stream/rules/sample_event.json +++ b/packages/google_workspace/data_stream/rules/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "776f9fab-6ea9-4ded-8c41-ad7eb70e1555", - "id": "ac62844a-a037-494e-aac7-b1b25ce7063c", - "name": "elastic-agent-45067", + "ephemeral_id": "f9501162-cab7-43e1-b483-818df864526f", + "id": "c3f09287-dd43-4314-8bf2-169c1e558717", + "name": "elastic-agent-92827", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.rules", - "namespace": "20633", + "namespace": "26329", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "ac62844a-a037-494e-aac7-b1b25ce7063c", + "id": "c3f09287-dd43-4314-8bf2-169c1e558717", "snapshot": false, "version": "8.19.4" }, @@ -26,10 +26,10 @@ "category": [ "intrusion_detection" ], - "created": "2026-07-22T07:04:40.667Z", + "created": "2026-07-29T04:13:30.176Z", "dataset": "google_workspace.rules", "id": "1", - "ingested": "2026-07-22T07:04:43Z", + "ingested": "2026-07-29T04:13:33Z", "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "rules", diff --git a/packages/google_workspace/docs/README.md b/packages/google_workspace/docs/README.md index d75d4106a5e..b5a12e12076 100644 --- a/packages/google_workspace/docs/README.md +++ b/packages/google_workspace/docs/README.md @@ -524,22 +524,22 @@ An example event for `login` looks as following: { "@timestamp": "2022-05-04T15:04:05.000Z", "agent": { - "ephemeral_id": "8c93a4fd-7826-41c7-93c5-049492fbb595", - "id": "a1cb9595-5cce-49de-b682-888fdfb0238e", - "name": "elastic-agent-11695", + "ephemeral_id": "e4048d3d-afb8-4c10-adc4-95dcd300b19e", + "id": "80a855c8-f052-4ef6-b0ca-053ae021cfa2", + "name": "elastic-agent-55461", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.login", - "namespace": "40160", + "namespace": "86206", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "a1cb9595-5cce-49de-b682-888fdfb0238e", + "id": "80a855c8-f052-4ef6-b0ca-053ae021cfa2", "snapshot": false, "version": "8.19.4" }, @@ -549,10 +549,10 @@ An example event for `login` looks as following: "category": [ "iam" ], - "created": "2026-07-22T07:02:04.442Z", + "created": "2026-07-29T04:12:29.868Z", "dataset": "google_workspace.login", "id": "1", - "ingested": "2026-07-22T07:02:07Z", + "ingested": "2026-07-29T04:12:32Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "login", @@ -666,22 +666,22 @@ An example event for `rules` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "776f9fab-6ea9-4ded-8c41-ad7eb70e1555", - "id": "ac62844a-a037-494e-aac7-b1b25ce7063c", - "name": "elastic-agent-45067", + "ephemeral_id": "f9501162-cab7-43e1-b483-818df864526f", + "id": "c3f09287-dd43-4314-8bf2-169c1e558717", + "name": "elastic-agent-92827", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.rules", - "namespace": "20633", + "namespace": "26329", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "ac62844a-a037-494e-aac7-b1b25ce7063c", + "id": "c3f09287-dd43-4314-8bf2-169c1e558717", "snapshot": false, "version": "8.19.4" }, @@ -691,10 +691,10 @@ An example event for `rules` looks as following: "category": [ "intrusion_detection" ], - "created": "2026-07-22T07:04:40.667Z", + "created": "2026-07-29T04:13:30.176Z", "dataset": "google_workspace.rules", "id": "1", - "ingested": "2026-07-22T07:04:43Z", + "ingested": "2026-07-29T04:13:33Z", "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "rules", @@ -1771,22 +1771,22 @@ An example event for `device` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "fa7c7a33-e988-49e4-81ec-a86495301da8", - "id": "0092765f-1d94-4789-973f-de5714762cd5", - "name": "elastic-agent-50116", + "ephemeral_id": "cf7859d2-bcd3-4e91-9434-5af0f3d3f6bc", + "id": "af766712-5402-4b83-931f-6d151f49defa", + "name": "elastic-agent-99347", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.device", - "namespace": "12815", + "namespace": "35081", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "0092765f-1d94-4789-973f-de5714762cd5", + "id": "af766712-5402-4b83-931f-6d151f49defa", "snapshot": false, "version": "8.19.4" }, @@ -1797,10 +1797,10 @@ An example event for `device` looks as following: "host", "package" ], - "created": "2026-07-22T06:57:43.273Z", + "created": "2026-07-29T04:10:28.571Z", "dataset": "google_workspace.device", "id": "1", - "ingested": "2026-07-22T06:57:46Z", + "ingested": "2026-07-29T04:10:31Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "outcome": "failure", @@ -2049,22 +2049,22 @@ An example event for `group_enterprise` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "6a987c97-d057-4150-91e1-a2bd50c5e6da", - "id": "18b072b8-ac88-483c-a90d-49c240a62c32", - "name": "elastic-agent-95571", + "ephemeral_id": "679861d5-ade4-46b9-9625-bee639c322dd", + "id": "2e034b60-759e-4978-b9d0-314065ff8fd8", + "name": "elastic-agent-96066", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.group_enterprise", - "namespace": "54811", + "namespace": "61974", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "18b072b8-ac88-483c-a90d-49c240a62c32", + "id": "2e034b60-759e-4978-b9d0-314065ff8fd8", "snapshot": false, "version": "8.19.4" }, @@ -2075,10 +2075,10 @@ An example event for `group_enterprise` looks as following: "iam", "configuration" ], - "created": "2026-07-22T06:59:56.725Z", + "created": "2026-07-29T04:11:31.741Z", "dataset": "google_workspace.group_enterprise", "id": "1", - "ingested": "2026-07-22T06:59:59Z", + "ingested": "2026-07-29T04:11:34Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}],\"type\":\"moderator_action\"},\"id\":{\"applicationName\":\"group_enterprise\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "provider": "group_enterprise", @@ -2972,15 +2972,15 @@ An example event for `chrome` looks as following: { "@timestamp": "2024-12-09T14:18:25.405Z", "agent": { - "ephemeral_id": "2b7f7f2f-6c69-4d6b-8edd-948ca3c6f110", - "id": "21d74789-d99d-4dfe-af4a-2288b3a564de", - "name": "elastic-agent-48415", + "ephemeral_id": "badc7085-7c02-4c86-b76e-394e9ca1d669", + "id": "e361e869-51a3-4e11-9525-c96595319143", + "name": "elastic-agent-34701", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chrome", - "namespace": "80177", + "namespace": "37207", "type": "logs" }, "device": { @@ -2992,7 +2992,7 @@ An example event for `chrome` looks as following: "version": "8.16.0" }, "elastic_agent": { - "id": "21d74789-d99d-4dfe-af4a-2288b3a564de", + "id": "e361e869-51a3-4e11-9525-c96595319143", "snapshot": false, "version": "8.19.4" }, @@ -3004,7 +3004,7 @@ An example event for `chrome` looks as following: ], "dataset": "google_workspace.chrome", "id": "-3640711002716937498", - "ingested": "2026-07-22T06:55:21Z", + "ingested": "2026-07-29T04:09:32Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh.kumar@example.io\",\"profileId\":\"109689693170624712102\"},\"etag\":\"\\\"CfV-pEPVZc7PJf2fWsHJTliD34MdGbO8iFIk3L4uBwQ/cBsNSJx2A9Lg8kiQCGLddmq827A\\\"\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"lmjegmlicamnimmfhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"02gajno12larrqx\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", @@ -3362,22 +3362,22 @@ An example event for `calendar` looks as following: { "@timestamp": "2025-04-01T07:00:40.262Z", "agent": { - "ephemeral_id": "bff7fec7-4d40-45ad-be16-632427fab559", - "id": "b3774315-d26c-4bf5-9778-d470566fab35", - "name": "elastic-agent-85176", + "ephemeral_id": "833853f9-febd-4424-916d-902130ddaf9e", + "id": "c5aebc7f-a471-46b7-82c5-b172b336f7da", + "name": "elastic-agent-84379", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.calendar", - "namespace": "40687", + "namespace": "15097", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "b3774315-d26c-4bf5-9778-d470566fab35", + "id": "c5aebc7f-a471-46b7-82c5-b172b336f7da", "snapshot": false, "version": "8.19.4" }, @@ -3389,7 +3389,7 @@ An example event for `calendar` looks as following: ], "dataset": "google_workspace.calendar", "id": "1", - "ingested": "2026-07-22T07:07:30Z", + "ingested": "2026-07-29T04:07:36Z", "kind": "event", "original": "{\"actor\":{\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"delete_calendar\",\"parameters\":[{\"name\":\"calendar_id\",\"value\":\"c_abc123@group.calendar.google.com\"},{\"name\":\"api_kind\",\"value\":\"web\"},{\"name\":\"user_agent\",\"value\":\"Mozilla/5.0\"}],\"type\":\"calendar_change\"},\"id\":{\"applicationName\":\"calendar\",\"customerId\":\"1\",\"time\":\"2025-04-01T07:00:40.262Z\",\"uniqueQualifier\":\"1\"},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "calendar", @@ -3539,22 +3539,22 @@ An example event for `chat` looks as following: { "@timestamp": "2025-03-26T05:55:02.063Z", "agent": { - "ephemeral_id": "6449a9b1-d610-4094-960a-4e43c2c87006", - "id": "13ad2886-85c9-43e5-8293-9bd32dbf1657", - "name": "elastic-agent-40045", + "ephemeral_id": "63e3d48f-55f0-4329-97a7-ccb77d539f2a", + "id": "8f3a240d-a025-4cfc-a3d2-0569d269a1fe", + "name": "elastic-agent-60488", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chat", - "namespace": "80821", + "namespace": "13343", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "13ad2886-85c9-43e5-8293-9bd32dbf1657", + "id": "8f3a240d-a025-4cfc-a3d2-0569d269a1fe", "snapshot": false, "version": "8.19.4" }, @@ -3566,7 +3566,7 @@ An example event for `chat` looks as following: ], "dataset": "google_workspace.chat", "id": "1", - "ingested": "2026-07-22T06:53:39Z", + "ingested": "2026-07-29T04:08:34Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\",\"events\":{\"name\":\"room_name_updated\",\"parameters\":[{\"name\":\"room_id\",\"value\":\"1\"},{\"name\":\"actor\",\"value\":\"foo@bar.com\"},{\"name\":\"room_name\",\"value\":\"TEST3\"},{\"name\":\"external_room\",\"value\":\"DISABLED\"},{\"name\":\"actor_type\",\"value\":\"NON_ADMIN\"},{\"name\":\"conversation_type\",\"value\":\"SPACE\"},{\"name\":\"conversation_ownership\",\"value\":\"INTERNALLY_OWNED\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"chat\",\"customerId\":\"1\",\"time\":\"2025-03-26T05:55:02.063Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "chat", diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json index 945b93dbb75..6cbb4d4634b 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json @@ -11,8 +11,7 @@ ], "kind": "event", "type": [ - "change", - "info" + "change" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json index 4b76f2d0698..7d6ee631058 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-patch-policy-completed.json-expected.json @@ -13,8 +13,7 @@ "kind": "event", "outcome": "success", "type": [ - "change", - "info" + "change" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json index b62cde6682e..c015c7f3db2 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-policy-finished.json-expected.json @@ -12,8 +12,7 @@ "kind": "event", "outcome": "success", "type": [ - "change", - "info" + "change" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json index 27c751727cd..a933c0ec017 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-push-capability-changed.json-expected.json @@ -11,8 +11,7 @@ ], "kind": "event", "type": [ - "change", - "info" + "change" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json index 42955661e9c..bb65acb16a0 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-device-added-to-dep.json-expected.json @@ -11,8 +11,7 @@ ], "kind": "event", "type": [ - "change", - "info" + "change" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json index 313c4fcddd6..b7552fab360 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-shutdown.json-expected.json @@ -11,8 +11,7 @@ ], "kind": "event", "type": [ - "end", - "info" + "end" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json index dd0ecb8e57d..e16681fd161 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-jss-startup.json-expected.json @@ -11,8 +11,7 @@ ], "kind": "event", "type": [ - "start", - "info" + "start" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json index 66b1f044385..f6d3e710ac2 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-command-completed.json-expected.json @@ -12,8 +12,7 @@ "kind": "event", "type": [ "change", - "end", - "info" + "end" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json index 0ee30fd1278..41d3468c5e7 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-enrolled.json-expected.json @@ -12,7 +12,7 @@ "kind": "event", "type": [ "change", - "info" + "start" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json index 858bbbed67e..3c5689d49dd 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-mobile-device-unenrolled.json-expected.json @@ -12,8 +12,7 @@ "kind": "event", "type": [ "change", - "end", - "info" + "end" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json index 8a98833003c..547dc605134 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-patch-software-title-updated.json-expected.json @@ -12,8 +12,7 @@ ], "kind": "event", "type": [ - "change", - "info" + "change" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json index 06db2d43cdc..93116ffe303 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-rest-api-operation.json-expected.json @@ -13,8 +13,7 @@ "outcome": "success", "type": [ "change", - "admin", - "info" + "admin" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json index 2d95115add5..f3d030bb84d 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-scep-challenge.json-expected.json @@ -12,8 +12,7 @@ ], "kind": "event", "type": [ - "start", - "info" + "start" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json index f278c5a6b3a..558f84045d4 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-computer-membership-change.json-expected.json @@ -13,8 +13,7 @@ "kind": "event", "type": [ "change", - "group", - "info" + "group" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json index 7e54925ed84..6924645cd2b 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-mobile-device-membership-change.json-expected.json @@ -13,8 +13,7 @@ "kind": "event", "type": [ "change", - "group", - "info" + "group" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json index ad3dca5f314..7a67b4d679d 100644 --- a/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json +++ b/packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-smart-group-user-membership-change.json-expected.json @@ -12,8 +12,7 @@ "kind": "event", "type": [ "change", - "group", - "info" + "group" ] }, "host": { diff --git a/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml index 93ffed0fced..b3e3201044d 100644 --- a/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -193,7 +193,7 @@ processors: ComputerCheckIn: { category: [host], type: [] } ComputerInventoryCompleted: { category: [host], type: [] } ComputerPushCapabilityChanged: { category: [host], type: [change] } - MobileDeviceEnrolled: { category: [host], type: [change] } + MobileDeviceEnrolled: { category: [host], type: [change, start] } MobileDeviceUnEnrolled: { category: [host], type: [change, end] } MobileDeviceCheckIn: { category: [host], type: [] } MobileDeviceInventoryCompleted: { category: [host], type: [] } @@ -212,17 +212,19 @@ processors: RestAPIOperation: { category: [api], type: [change, admin] } SmartGroupUserMembershipChange: { category: [iam], type: [change, group] } source: |- - def cats = new ArrayList(); - def types = new ArrayList(); def action = ctx.event?.action; - if (action != null) { - def entry = params.actions.get(action); - if (entry != null) { - if (entry.category != null) { cats.addAll(entry.category); } - if (entry.type != null) { types.addAll(entry.type); } - } + if (action == null) { + return; } - types.add('info'); + def entry = params.actions.get(action); + if (entry == null) { + return; + } + def cats = new ArrayList(); + def types = new ArrayList(); + if (entry.category != null) { cats.addAll(entry.category); } + if (entry.type != null) { types.addAll(entry.type); } + if (types.isEmpty()) { types.add('info'); } ctx.event = ctx.event ?: [:]; if (!cats.isEmpty()) { ctx.event.category = cats; } ctx.event.type = types; diff --git a/packages/jamf_pro/data_stream/events/sample_event.json b/packages/jamf_pro/data_stream/events/sample_event.json index a8c2e5c29d5..b8d8dc9ccdd 100644 --- a/packages/jamf_pro/data_stream/events/sample_event.json +++ b/packages/jamf_pro/data_stream/events/sample_event.json @@ -1,22 +1,22 @@ { - "@timestamp": "2026-07-26T14:37:39.817Z", + "@timestamp": "2026-07-29T03:47:37.429Z", "agent": { - "ephemeral_id": "7ff99866-0db2-4af0-8cd5-51957007a61c", - "id": "77cd4886-245a-43a6-a4eb-0a2737915527", - "name": "elastic-agent-62101", + "ephemeral_id": "14d3d101-ec1d-4152-be66-ea3a0103cf37", + "id": "da3cee98-ea12-42e4-bed8-53fa9ca483e0", + "name": "elastic-agent-22239", "type": "filebeat", "version": "8.19.2" }, "data_stream": { "dataset": "jamf_pro.events", - "namespace": "78205", + "namespace": "20970", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "77cd4886-245a-43a6-a4eb-0a2737915527", + "id": "da3cee98-ea12-42e4-bed8-53fa9ca483e0", "snapshot": false, "version": "8.19.2" }, @@ -27,12 +27,11 @@ "host" ], "dataset": "jamf_pro.events", - "ingested": "2026-07-26T14:37:40Z", + "ingested": "2026-07-29T03:47:38Z", "kind": "event", "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}", "type": [ - "change", - "info" + "change" ] }, "host": { diff --git a/packages/jamf_pro/docs/README.md b/packages/jamf_pro/docs/README.md index d88b42c7771..591ba71c8d5 100644 --- a/packages/jamf_pro/docs/README.md +++ b/packages/jamf_pro/docs/README.md @@ -393,24 +393,24 @@ An example event for `events` looks as following: ```json { - "@timestamp": "2026-07-26T14:37:39.817Z", + "@timestamp": "2026-07-29T03:47:37.429Z", "agent": { - "ephemeral_id": "7ff99866-0db2-4af0-8cd5-51957007a61c", - "id": "77cd4886-245a-43a6-a4eb-0a2737915527", - "name": "elastic-agent-62101", + "ephemeral_id": "14d3d101-ec1d-4152-be66-ea3a0103cf37", + "id": "da3cee98-ea12-42e4-bed8-53fa9ca483e0", + "name": "elastic-agent-22239", "type": "filebeat", "version": "8.19.2" }, "data_stream": { "dataset": "jamf_pro.events", - "namespace": "78205", + "namespace": "20970", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "77cd4886-245a-43a6-a4eb-0a2737915527", + "id": "da3cee98-ea12-42e4-bed8-53fa9ca483e0", "snapshot": false, "version": "8.19.2" }, @@ -421,12 +421,11 @@ An example event for `events` looks as following: "host" ], "dataset": "jamf_pro.events", - "ingested": "2026-07-26T14:37:40Z", + "ingested": "2026-07-29T03:47:38Z", "kind": "event", "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}", "type": [ - "change", - "info" + "change" ] }, "host": { diff --git a/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 2e446ec4fb5..f006b4ad421 100644 --- a/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sublime_security/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -460,6 +460,12 @@ processors: - append: field: error.message value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: event.type + tag: append_info_into_event_type + value: info + allow_duplicates: false + if: ctx.event?.type == null - remove: field: - sublime_security.audit.created_at diff --git a/packages/sublime_security/data_stream/audit/sample_event.json b/packages/sublime_security/data_stream/audit/sample_event.json index f0c3247f412..b0bd19d1095 100644 --- a/packages/sublime_security/data_stream/audit/sample_event.json +++ b/packages/sublime_security/data_stream/audit/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2024-08-12T06:04:03.714Z", "agent": { - "ephemeral_id": "2b197f60-692d-486d-929b-af4554d5af39", - "id": "c74dc03b-0bc0-472c-81a8-dea343a0631e", - "name": "elastic-agent-43723", + "ephemeral_id": "8e6eda80-4486-4b87-9073-d66d3c84a625", + "id": "a0c4e994-ec73-49cb-83eb-6ecb9baf45f7", + "name": "elastic-agent-91904", "type": "filebeat", "version": "8.18.0" }, "data_stream": { "dataset": "sublime_security.audit", - "namespace": "55804", + "namespace": "40350", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "c74dc03b-0bc0-472c-81a8-dea343a0631e", + "id": "a0c4e994-ec73-49cb-83eb-6ecb9baf45f7", "snapshot": false, "version": "8.18.0" }, @@ -28,7 +28,7 @@ ], "dataset": "sublime_security.audit", "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", - "ingested": "2026-07-21T17:26:37Z", + "ingested": "2026-07-29T03:43:39Z", "kind": "event", "original": "{\"created_at\":\"2024-08-12T06:04:03.714126Z\",\"created_by\":{\"active\":true,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"email_address\":\"demo@example.com\",\"first_name\":\"Demo\",\"google_oauth_user_id\":\"d83rb8et4-refe-fe7t4f8efe\",\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"is_enrolled\":true,\"last_name\":\"User\",\"microsoft_oauth_user_id\":\"fhe7t4bgf8-freu-ebfur94ref\",\"phone_number\":null,\"role\":\"admin\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\"},\"data\":{\"request\":{\"api_key_name\":\"demo mode local\",\"authentication_method\":\"api_key\",\"body\":\"\",\"id\":\"6ad202de-0def-423d-a0f2-549402e1a9c9\",\"ip\":\"1.128.0.0\",\"method\":\"GET\",\"path\":\"/v0/message-groups\",\"user_agent\":\"Go-http-client/1.1\"}},\"id\":\"bd49af79-0cfb-4184-bd18-b0401d69ac61\",\"type\":\"message_group.search\"}", "type": [ diff --git a/packages/sublime_security/docs/README.md b/packages/sublime_security/docs/README.md index 426b718f81e..61463ef8f24 100644 --- a/packages/sublime_security/docs/README.md +++ b/packages/sublime_security/docs/README.md @@ -87,22 +87,22 @@ An example event for `audit` looks as following: { "@timestamp": "2024-08-12T06:04:03.714Z", "agent": { - "ephemeral_id": "2b197f60-692d-486d-929b-af4554d5af39", - "id": "c74dc03b-0bc0-472c-81a8-dea343a0631e", - "name": "elastic-agent-43723", + "ephemeral_id": "8e6eda80-4486-4b87-9073-d66d3c84a625", + "id": "a0c4e994-ec73-49cb-83eb-6ecb9baf45f7", + "name": "elastic-agent-91904", "type": "filebeat", "version": "8.18.0" }, "data_stream": { "dataset": "sublime_security.audit", - "namespace": "55804", + "namespace": "40350", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "c74dc03b-0bc0-472c-81a8-dea343a0631e", + "id": "a0c4e994-ec73-49cb-83eb-6ecb9baf45f7", "snapshot": false, "version": "8.18.0" }, @@ -114,7 +114,7 @@ An example event for `audit` looks as following: ], "dataset": "sublime_security.audit", "id": "bd49af79-0cfb-4184-bd18-b0401d69ac61", - "ingested": "2026-07-21T17:26:37Z", + "ingested": "2026-07-29T03:43:39Z", "kind": "event", "original": "{\"created_at\":\"2024-08-12T06:04:03.714126Z\",\"created_by\":{\"active\":true,\"created_at\":\"2024-07-12T05:13:47.879426Z\",\"email_address\":\"demo@example.com\",\"first_name\":\"Demo\",\"google_oauth_user_id\":\"d83rb8et4-refe-fe7t4f8efe\",\"id\":\"6e6eca05-4fea-406b-86d4-b40177e25474\",\"is_enrolled\":true,\"last_name\":\"User\",\"microsoft_oauth_user_id\":\"fhe7t4bgf8-freu-ebfur94ref\",\"phone_number\":null,\"role\":\"admin\",\"updated_at\":\"2024-07-12T05:13:47.879426Z\"},\"data\":{\"request\":{\"api_key_name\":\"demo mode local\",\"authentication_method\":\"api_key\",\"body\":\"\",\"id\":\"6ad202de-0def-423d-a0f2-549402e1a9c9\",\"ip\":\"1.128.0.0\",\"method\":\"GET\",\"path\":\"/v0/message-groups\",\"user_agent\":\"Go-http-client/1.1\"}},\"id\":\"bd49af79-0cfb-4184-bd18-b0401d69ac61\",\"type\":\"message_group.search\"}", "type": [ From fb9cc32c2b5e0998ed0e39f1cb7e6e4d9c569401 Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Wed, 29 Jul 2026 11:35:46 +0530 Subject: [PATCH 8/9] address comments --- .../elasticsearch/ingest_pipeline/default.yml | 9 +- .../data_stream/calendar/sample_event.json | 12 +- .../elasticsearch/ingest_pipeline/default.yml | 9 +- .../data_stream/chat/sample_event.json | 12 +- .../elasticsearch/ingest_pipeline/default.yml | 9 +- .../data_stream/chrome/sample_event.json | 12 +- .../elasticsearch/ingest_pipeline/default.yml | 5 + .../context_aware_access/sample_event.json | 19 ++- .../elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/device/sample_event.json | 14 +- .../elasticsearch/ingest_pipeline/default.yml | 6 +- .../data_stream/gcp/sample_event.json | 14 +- .../elasticsearch/ingest_pipeline/default.yml | 9 +- .../data_stream/keep/sample_event.json | 12 +- .../elasticsearch/ingest_pipeline/default.yml | 6 +- .../data_stream/login/sample_event.json | 14 +- .../test/pipeline/test-meet.log-expected.json | 18 --- .../elasticsearch/ingest_pipeline/default.yml | 11 +- .../data_stream/meet/sample_event.json | 15 +- .../elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/rules/sample_event.json | 14 +- .../elasticsearch/ingest_pipeline/default.yml | 18 ++- .../data_stream/vault/sample_event.json | 12 +- packages/google_workspace/docs/README.md | 150 +++++++++--------- 24 files changed, 206 insertions(+), 198 deletions(-) diff --git a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml index cce724a1bf0..f0497f562a3 100644 --- a/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml @@ -187,9 +187,12 @@ processors: interop_exchange_resource_list_lookup_unsuccessful: info source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.calendar.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.calendar.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/calendar/sample_event.json b/packages/google_workspace/data_stream/calendar/sample_event.json index cbe9b70be22..de40b7e420e 100644 --- a/packages/google_workspace/data_stream/calendar/sample_event.json +++ b/packages/google_workspace/data_stream/calendar/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2025-04-01T07:00:40.262Z", "agent": { - "ephemeral_id": "833853f9-febd-4424-916d-902130ddaf9e", - "id": "c5aebc7f-a471-46b7-82c5-b172b336f7da", - "name": "elastic-agent-84379", + "ephemeral_id": "0bf0c46e-128f-4c5f-9ef3-be0324853874", + "id": "84d83968-c050-49a6-a9f8-d1430810bcdc", + "name": "elastic-agent-49212", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.calendar", - "namespace": "15097", + "namespace": "66608", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "c5aebc7f-a471-46b7-82c5-b172b336f7da", + "id": "84d83968-c050-49a6-a9f8-d1430810bcdc", "snapshot": false, "version": "8.19.4" }, @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.calendar", "id": "1", - "ingested": "2026-07-29T04:07:36Z", + "ingested": "2026-07-29T05:49:29Z", "kind": "event", "original": "{\"actor\":{\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"delete_calendar\",\"parameters\":[{\"name\":\"calendar_id\",\"value\":\"c_abc123@group.calendar.google.com\"},{\"name\":\"api_kind\",\"value\":\"web\"},{\"name\":\"user_agent\",\"value\":\"Mozilla/5.0\"}],\"type\":\"calendar_change\"},\"id\":{\"applicationName\":\"calendar\",\"customerId\":\"1\",\"time\":\"2025-04-01T07:00:40.262Z\",\"uniqueQualifier\":\"1\"},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "calendar", diff --git a/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml index 09ea0b1e879..50b012b0fdb 100644 --- a/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/chat/elasticsearch/ingest_pipeline/default.yml @@ -177,9 +177,12 @@ processors: user_unblocked: change source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.chat.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.chat.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/chat/sample_event.json b/packages/google_workspace/data_stream/chat/sample_event.json index 9c1f8775a88..766450b14f1 100644 --- a/packages/google_workspace/data_stream/chat/sample_event.json +++ b/packages/google_workspace/data_stream/chat/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2025-03-26T05:55:02.063Z", "agent": { - "ephemeral_id": "63e3d48f-55f0-4329-97a7-ccb77d539f2a", - "id": "8f3a240d-a025-4cfc-a3d2-0569d269a1fe", - "name": "elastic-agent-60488", + "ephemeral_id": "aaf2abc8-196a-4187-b608-1f0a3cb6d0da", + "id": "bbe3c33a-56b4-4151-a0af-5a101bfb9189", + "name": "elastic-agent-33417", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chat", - "namespace": "13343", + "namespace": "83717", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "8f3a240d-a025-4cfc-a3d2-0569d269a1fe", + "id": "bbe3c33a-56b4-4151-a0af-5a101bfb9189", "snapshot": false, "version": "8.19.4" }, @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.chat", "id": "1", - "ingested": "2026-07-29T04:08:34Z", + "ingested": "2026-07-29T05:51:24Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\",\"events\":{\"name\":\"room_name_updated\",\"parameters\":[{\"name\":\"room_id\",\"value\":\"1\"},{\"name\":\"actor\",\"value\":\"foo@bar.com\"},{\"name\":\"room_name\",\"value\":\"TEST3\"},{\"name\":\"external_room\",\"value\":\"DISABLED\"},{\"name\":\"actor_type\",\"value\":\"NON_ADMIN\"},{\"name\":\"conversation_type\",\"value\":\"SPACE\"},{\"name\":\"conversation_ownership\",\"value\":\"INTERNALLY_OWNED\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"chat\",\"customerId\":\"1\",\"time\":\"2025-03-26T05:55:02.063Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "chat", diff --git a/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml index 0d958965def..b3df59998f9 100644 --- a/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml @@ -183,9 +183,12 @@ processors: if (ctx.event == null) { ctx.event = new HashMap(); } - def type = new ArrayList(); - type.add(params.get(ctx.google_workspace.chrome.name.toLowerCase())); - ctx.event.put('type', type); + def type = params.get(ctx.google_workspace.chrome.name.toLowerCase()); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.put('type', [type]); + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/chrome/sample_event.json b/packages/google_workspace/data_stream/chrome/sample_event.json index 3391ee4a2b7..bb8c1d4f36b 100644 --- a/packages/google_workspace/data_stream/chrome/sample_event.json +++ b/packages/google_workspace/data_stream/chrome/sample_event.json @@ -1,15 +1,15 @@ { "@timestamp": "2024-12-09T14:18:25.405Z", "agent": { - "ephemeral_id": "badc7085-7c02-4c86-b76e-394e9ca1d669", - "id": "e361e869-51a3-4e11-9525-c96595319143", - "name": "elastic-agent-34701", + "ephemeral_id": "9fe95630-3cd8-4a6b-9284-34a97968419d", + "id": "fd20d16d-a4f3-4cf2-954f-302994a9b79a", + "name": "elastic-agent-84798", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chrome", - "namespace": "37207", + "namespace": "17212", "type": "logs" }, "device": { @@ -21,7 +21,7 @@ "version": "8.16.0" }, "elastic_agent": { - "id": "e361e869-51a3-4e11-9525-c96595319143", + "id": "fd20d16d-a4f3-4cf2-954f-302994a9b79a", "snapshot": false, "version": "8.19.4" }, @@ -33,7 +33,7 @@ ], "dataset": "google_workspace.chrome", "id": "-3640711002716937498", - "ingested": "2026-07-29T04:09:32Z", + "ingested": "2026-07-29T05:53:08Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh.kumar@example.io\",\"profileId\":\"109689693170624712102\"},\"etag\":\"\\\"CfV-pEPVZc7PJf2fWsHJTliD34MdGbO8iFIk3L4uBwQ/cBsNSJx2A9Lg8kiQCGLddmq827A\\\"\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"lmjegmlicamnimmfhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"02gajno12larrqx\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", diff --git a/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml index 6c050d7c364..f2fe01fbad0 100644 --- a/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml @@ -349,6 +349,11 @@ processors: tag: set_event_outcome_to_failure value: failure if: ctx.event?.action != null && ["ACCESS_DENY_EVENT","ACCESS_DENY_INTERNAL_ERROR_EVENT","MONITOR_MODE_ACCESS_DENY_EVENT"].contains(ctx.event.action) + - append: + field: event.type + tag: append_info_into_event_type + value: info + if: ctx.event?.type == null - remove: field: - json diff --git a/packages/google_workspace/data_stream/context_aware_access/sample_event.json b/packages/google_workspace/data_stream/context_aware_access/sample_event.json index a7536b53f08..61c54f27377 100644 --- a/packages/google_workspace/data_stream/context_aware_access/sample_event.json +++ b/packages/google_workspace/data_stream/context_aware_access/sample_event.json @@ -1,35 +1,38 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "3a36557f-f0d1-4a59-8361-19a8609a8d7a", - "id": "65ce985f-497e-456d-b6d8-e0c0f3864a08", - "name": "elastic-agent-64228", + "ephemeral_id": "2bce9511-e030-46d7-9831-d1f283b800ea", + "id": "ffe11690-540e-4299-b8cf-e77d2ba51356", + "name": "elastic-agent-87207", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.context_aware_access", - "namespace": "65428", + "namespace": "22169", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "65ce985f-497e-456d-b6d8-e0c0f3864a08", + "id": "ffe11690-540e-4299-b8cf-e77d2ba51356", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2026-07-22T06:56:35.154Z", + "created": "2026-07-29T05:54:50.248Z", "dataset": "google_workspace.context_aware_access", "id": "1", - "ingested": "2026-07-22T06:56:38Z", + "ingested": "2026-07-29T05:54:53Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "provider": "device", + "type": [ + "info" + ] }, "google_workspace": { "actor": { diff --git a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml index 51012251b48..532e93d7b09 100644 --- a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml @@ -648,7 +648,7 @@ processors: tag: set_event_outcome_to_failure_from_password_attempts value: failure if: >- - ctx?.event?.action == "FAILED_PASSWORD_ATTEMPTS_EVENT" && + ctx.event?.action == "FAILED_PASSWORD_ATTEMPTS_EVENT" && ctx.google_workspace?.device?.failed_passwd_attempts != null && ctx.google_workspace.device.failed_passwd_attempts > 0 - foreach: diff --git a/packages/google_workspace/data_stream/device/sample_event.json b/packages/google_workspace/data_stream/device/sample_event.json index 80efcf74871..dd2002b52f3 100644 --- a/packages/google_workspace/data_stream/device/sample_event.json +++ b/packages/google_workspace/data_stream/device/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "cf7859d2-bcd3-4e91-9434-5af0f3d3f6bc", - "id": "af766712-5402-4b83-931f-6d151f49defa", - "name": "elastic-agent-99347", + "ephemeral_id": "14e1b701-1317-425c-ba20-03919fb88569", + "id": "5c4c52d8-4476-42f6-96cc-3cc0946ae3ab", + "name": "elastic-agent-10485", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.device", - "namespace": "35081", + "namespace": "25697", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "af766712-5402-4b83-931f-6d151f49defa", + "id": "5c4c52d8-4476-42f6-96cc-3cc0946ae3ab", "snapshot": false, "version": "8.19.4" }, @@ -27,10 +27,10 @@ "host", "package" ], - "created": "2026-07-29T04:10:28.571Z", + "created": "2026-07-29T05:55:46.418Z", "dataset": "google_workspace.device", "id": "1", - "ingested": "2026-07-29T04:10:31Z", + "ingested": "2026-07-29T05:55:49Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "outcome": "failure", diff --git a/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml index e7ee7b7ba34..b55c5b55d5d 100644 --- a/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml @@ -243,12 +243,12 @@ processors: field: event.category tag: append_iam_into_event_category value: iam - if: ctx?.event?.action != null + if: ctx.event?.action != null - append: field: event.type tag: append_creation_into_event_type value: creation - if: ctx.event?.action != null && ["IMPORT_SSH_PUBLIC_KEY"].contains(ctx.event.action) + if: ctx.event?.action == 'IMPORT_SSH_PUBLIC_KEY' - append: field: event.type tag: append_deletion_into_event_type @@ -263,7 +263,7 @@ processors: field: event.type tag: append_change_into_event_type value: change - if: ctx.event?.action != null && ["UPDATE_SSH_PUBLIC_KEY"].contains(ctx.event.action) + if: ctx.event?.action == 'UPDATE_SSH_PUBLIC_KEY' - append: field: event.type tag: append_info_into_event_type_for_unknown_gcp_action diff --git a/packages/google_workspace/data_stream/gcp/sample_event.json b/packages/google_workspace/data_stream/gcp/sample_event.json index cdda850af0e..23e830f3011 100644 --- a/packages/google_workspace/data_stream/gcp/sample_event.json +++ b/packages/google_workspace/data_stream/gcp/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "e462c95e-fc7b-4e8c-8e17-c078bbd6363a", - "id": "3be6ee34-e840-4202-a088-f8cbacd473b4", - "name": "elastic-agent-95567", + "ephemeral_id": "2f60bf92-3781-4831-b19c-792f8565bbef", + "id": "25ffa2e6-eaa5-4bed-82e9-ca0ad5868dc0", + "name": "elastic-agent-57067", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.gcp", - "namespace": "98644", + "namespace": "20316", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "3be6ee34-e840-4202-a088-f8cbacd473b4", + "id": "25ffa2e6-eaa5-4bed-82e9-ca0ad5868dc0", "snapshot": false, "version": "8.19.4" }, @@ -26,10 +26,10 @@ "category": [ "iam" ], - "created": "2026-07-22T06:59:03.390Z", + "created": "2026-07-29T05:57:22.727Z", "dataset": "google_workspace.gcp", "id": "1", - "ingested": "2026-07-22T06:59:06Z", + "ingested": "2026-07-29T05:57:25Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"foo@bar.com\"}],\"type\":\"CLOUD_OSLOGIN\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "provider": "device", diff --git a/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml index c28dca3f3c1..10072a75a86 100644 --- a/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/keep/elasticsearch/ingest_pipeline/default.yml @@ -117,9 +117,12 @@ processors: modified_acl: change source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.keep.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.keep.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/keep/sample_event.json b/packages/google_workspace/data_stream/keep/sample_event.json index 48b817ab56f..fbe8271ffa5 100644 --- a/packages/google_workspace/data_stream/keep/sample_event.json +++ b/packages/google_workspace/data_stream/keep/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2025-03-27T12:45:08.310Z", "agent": { - "ephemeral_id": "a1dc4da9-10b6-4671-b3d9-20f0c9558c3f", - "id": "a1731c07-db09-45af-aa19-cd51604e7136", - "name": "elastic-agent-87212", + "ephemeral_id": "6ea4e32f-5b2f-44c5-94a1-eb8f3a056d96", + "id": "f2e914a5-6687-4f3d-8e76-23a4996e4b93", + "name": "elastic-agent-26560", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.keep", - "namespace": "60175", + "namespace": "43435", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "a1731c07-db09-45af-aa19-cd51604e7136", + "id": "f2e914a5-6687-4f3d-8e76-23a4996e4b93", "snapshot": false, "version": "8.19.4" }, @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.keep", "id": "0", - "ingested": "2026-07-22T07:00:49Z", + "ingested": "2026-07-29T05:59:04Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\",\"events\":{\"name\":\"uploaded_attachment\",\"parameters\":[{\"name\":\"owner_email\",\"value\":\"foo@bar.com\"},{\"name\":\"note_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz\"},{\"name\":\"attachment_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"keep\",\"customerId\":\"1\",\"time\":\"2025-03-27T12:45:08.310Z\",\"uniqueQualifier\":\"0\"},\"kind\":\"admin#reports#activity\"}", "provider": "keep", diff --git a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml index a09b03f28e8..f8ac1decc2f 100644 --- a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml @@ -154,7 +154,7 @@ processors: - append: field: event.category value: iam - if: '["account_disabled_password_leak","2sv_disable","2sv_enroll","account_disabled_generic","account_disabled_spamming_through_relay","account_disabled_spamming","account_disabled_hijacked","titanium_enroll","titanium_unenroll","gov_attack_warning","passkey_enrolled","passkey_removed"].contains(ctx?.event?.action)' + if: '["account_disabled_password_leak","2sv_disable","2sv_enroll","account_disabled_generic","account_disabled_spamming_through_relay","account_disabled_spamming","account_disabled_hijacked","titanium_enroll","titanium_unenroll","gov_attack_warning","passkey_enrolled","passkey_removed"].contains(ctx.event?.action)' - append: field: event.category value: configuration @@ -183,12 +183,12 @@ processors: field: event.type tag: append_creation_into_event_type_for_passkey_enrolled value: creation - if: '["passkey_enrolled"].contains(ctx?.event?.action)' + if: ctx.event?.action == 'passkey_enrolled' - append: field: event.type tag: append_deletion_into_event_type_for_passkey_removed value: deletion - if: '["passkey_removed"].contains(ctx?.event?.action)' + if: ctx.event?.action == 'passkey_removed' - append: field: event.type value: info diff --git a/packages/google_workspace/data_stream/login/sample_event.json b/packages/google_workspace/data_stream/login/sample_event.json index f35de628d27..27fd41d24c1 100644 --- a/packages/google_workspace/data_stream/login/sample_event.json +++ b/packages/google_workspace/data_stream/login/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2022-05-04T15:04:05.000Z", "agent": { - "ephemeral_id": "e4048d3d-afb8-4c10-adc4-95dcd300b19e", - "id": "80a855c8-f052-4ef6-b0ca-053ae021cfa2", - "name": "elastic-agent-55461", + "ephemeral_id": "bed60d5c-4818-4532-b154-8552a207963d", + "id": "216537c1-0624-4a33-8211-e63900f3f8ea", + "name": "elastic-agent-60367", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.login", - "namespace": "86206", + "namespace": "74725", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "80a855c8-f052-4ef6-b0ca-053ae021cfa2", + "id": "216537c1-0624-4a33-8211-e63900f3f8ea", "snapshot": false, "version": "8.19.4" }, @@ -26,10 +26,10 @@ "category": [ "iam" ], - "created": "2026-07-29T04:12:29.868Z", + "created": "2026-07-29T06:00:06.077Z", "dataset": "google_workspace.login", "id": "1", - "ingested": "2026-07-29T04:12:32Z", + "ingested": "2026-07-29T06:00:09Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "login", diff --git a/packages/google_workspace/data_stream/meet/_dev/test/pipeline/test-meet.log-expected.json b/packages/google_workspace/data_stream/meet/_dev/test/pipeline/test-meet.log-expected.json index d800f9c3b11..cd71078f2ac 100644 --- a/packages/google_workspace/data_stream/meet/_dev/test/pipeline/test-meet.log-expected.json +++ b/packages/google_workspace/data_stream/meet/_dev/test/pipeline/test-meet.log-expected.json @@ -265,9 +265,6 @@ }, "event": { "action": "invitation-sent", - "category": [ - "network" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-04-11T09:23:00.703Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"invitation_sent\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"meeting_code\", \"value\": \"NTBTYDTXBE\"}, {\"name\": \"conference_id\", \"value\": \"-PeisjX_5iUtKPuGffkJDaBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-04-11T09:23:00.703059Z\"}, {\"name\": \"target_user_count\", \"intValue\": \"1\"}, {\"name\": \"target_phone_number\", \"value\": \"-1\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", @@ -488,9 +485,6 @@ }, "event": { "action": "abuse-report-submitted", - "category": [ - "network" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:37:57.454Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"call\", \"name\": \"abuse_report_submitted\", \"parameters\": [{\"name\": \"meeting_code\", \"value\": \"AIVOTUUFCI\"}, {\"name\": \"conference_id\", \"value\": \"grSyUH5b8bsOXu8Bgz8RDaBcdEfgh\"}, {\"name\": \"organizer_email\", \"value\": \"foo@bar.com\"}, {\"name\": \"calendar_event_id\", \"value\": \"\"}, {\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"endpoint_id\", \"value\": \"boq_hlane_0BRgCp8YDYT\"}, {\"name\": \"device_type\", \"value\": \"web\"}, {\"name\": \"product_type\", \"value\": \"meet\"}, {\"name\": \"display_name\", \"value\": \"Richard Roe\"}, {\"name\": \"ip_address\", \"value\": \"67.43.156.13\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}, {\"name\": \"action_reason\", \"value\": \"spam\"}, {\"name\": \"action_description\", \"value\": \"fole language\"}, {\"name\": \"target_display_names\", \"value\": \"bob, alice\"}]}}", @@ -852,9 +846,6 @@ }, "event": { "action": "presentation-started", - "category": [ - "network" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:29:46.611Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"presentation_started\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"meeting_code\", \"value\": \"KIUPVSZBEZ\"}, {\"name\": \"conference_id\", \"value\": \"ovqzvH9gQJVI2h1IoL_aBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-03-25T10:29:46.611623Z\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", @@ -928,9 +919,6 @@ }, "event": { "action": "presentation-started", - "category": [ - "network" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:29:40.143Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"KEY\", \"key\": \"HANGOUTS_EXTERNAL_OR_ANONYMOUS\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"presentation_started\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": true}, {\"name\": \"meeting_code\", \"value\": \"KIUPVSZBEZ\"}, {\"name\": \"conference_id\", \"value\": \"ovqzvH9gQJVI2h1IoL_aBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-03-25T10:29:40.143797Z\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", @@ -1001,9 +989,6 @@ }, "event": { "action": "presentation-started", - "category": [ - "network" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:29:39.322Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"presentation_started\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"meeting_code\", \"value\": \"KIUPVSZBEZ\"}, {\"name\": \"conference_id\", \"value\": \"ovqzvH9gQJVI2h1IoL_aBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-03-25T10:29:39.322717Z\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", @@ -1077,9 +1062,6 @@ }, "event": { "action": "invitation-sent", - "category": [ - "network" - ], "id": "1", "kind": "event", "original": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-03-25T10:28:07.109Z\", \"uniqueQualifier\": \"1\", \"applicationName\": \"meet\", \"customerId\": \"1\"}, \"etag\": \"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\", \"actor\": {\"callerType\": \"USER\", \"email\": \"foo@bar.com\", \"profileId\": \"1\"}, \"events\": {\"type\": \"conference_action\", \"name\": \"invitation_sent\", \"parameters\": [{\"name\": \"is_external\", \"boolValue\": false}, {\"name\": \"meeting_code\", \"value\": \"KIUPVSZBEZ\"}, {\"name\": \"conference_id\", \"value\": \"ovqzvH9gQJVI2h1IoL_aBcdEfgh\"}, {\"name\": \"action_time\", \"value\": \"2025-03-25T10:28:07.109881Z\"}, {\"name\": \"target_user_count\", \"intValue\": \"1\"}, {\"name\": \"identifier\", \"value\": \"foo@bar.com\"}, {\"name\": \"identifier_type\", \"value\": \"email_address\"}]}}", diff --git a/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml index fff2f8cd33a..5e2b6aa6e8a 100644 --- a/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/meet/elasticsearch/ingest_pipeline/default.yml @@ -97,7 +97,7 @@ processors: field: event.category tag: append_network_into_event_category value: network - if: ctx.google_workspace?.meet?.name != null + if: '["call_ended","dialed_out","ring_sent","ring_answered","ring_missed"].contains(ctx.google_workspace?.meet?.name)' - script: description: Set event type based on event name. if: ctx.google_workspace?.meet?.name != null @@ -146,9 +146,12 @@ processors: whiteboard_started: info source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.meet.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.meet.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/meet/sample_event.json b/packages/google_workspace/data_stream/meet/sample_event.json index 99ab73cd3c2..d9a1cf45303 100644 --- a/packages/google_workspace/data_stream/meet/sample_event.json +++ b/packages/google_workspace/data_stream/meet/sample_event.json @@ -1,34 +1,31 @@ { "@timestamp": "2025-04-11T09:23:00.703059Z", "agent": { - "ephemeral_id": "71d11372-1a72-49b3-a1a6-37b19a3f7851", - "id": "722fe293-8487-43c7-bb6e-df12f5f19e44", - "name": "elastic-agent-18911", + "ephemeral_id": "aebece6a-1925-414e-a7e3-a86ced5bac7d", + "id": "a71b149d-2a6e-4e68-9259-193c896269fb", + "name": "elastic-agent-94649", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.meet", - "namespace": "47636", + "namespace": "85335", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "722fe293-8487-43c7-bb6e-df12f5f19e44", + "id": "a71b149d-2a6e-4e68-9259-193c896269fb", "snapshot": false, "version": "8.19.4" }, "event": { "action": "invitation-sent", "agent_id_status": "verified", - "category": [ - "network" - ], "dataset": "google_workspace.meet", "id": "1", - "ingested": "2026-07-22T07:03:23Z", + "ingested": "2026-07-29T06:01:09Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"invitation_sent\",\"parameters\":[{\"boolValue\":false,\"name\":\"is_external\"},{\"name\":\"meeting_code\",\"value\":\"NTBTYDTXBE\"},{\"name\":\"conference_id\",\"value\":\"-PeisjX_5iUtKPuGffkJDaBcdEfgh\"},{\"name\":\"action_time\",\"value\":\"2025-04-11T09:23:00.703059Z\"},{\"intValue\":\"1\",\"name\":\"target_user_count\"},{\"name\":\"identifier\",\"value\":\"foo@bar.com\"},{\"name\":\"identifier_type\",\"value\":\"email_address\"}],\"type\":\"conference_action\"},\"id\":{\"applicationName\":\"meet\",\"customerId\":\"1\",\"time\":\"2025-04-11T09:23:00.703Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "meet", diff --git a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml index 8c255aebd17..5687fdfa35f 100644 --- a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml @@ -523,7 +523,7 @@ processors: field: event.type tag: append_deletion_into_event_type_for_label_removed value: deletion - if: ctx.event?.action != null && ["label_removed"].contains(ctx.event.action) + if: ctx.event?.action == 'label_removed' - set: field: event.kind tag: set_event_kind_to_alert diff --git a/packages/google_workspace/data_stream/rules/sample_event.json b/packages/google_workspace/data_stream/rules/sample_event.json index 2f7a22c061f..a11ad635578 100644 --- a/packages/google_workspace/data_stream/rules/sample_event.json +++ b/packages/google_workspace/data_stream/rules/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "f9501162-cab7-43e1-b483-818df864526f", - "id": "c3f09287-dd43-4314-8bf2-169c1e558717", - "name": "elastic-agent-92827", + "ephemeral_id": "6dd44921-df3e-4058-b8a7-f864acac8e0f", + "id": "901c8bf0-0fa4-4132-a0be-09269156a5fc", + "name": "elastic-agent-91966", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.rules", - "namespace": "26329", + "namespace": "89516", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "c3f09287-dd43-4314-8bf2-169c1e558717", + "id": "901c8bf0-0fa4-4132-a0be-09269156a5fc", "snapshot": false, "version": "8.19.4" }, @@ -26,10 +26,10 @@ "category": [ "intrusion_detection" ], - "created": "2026-07-29T04:13:30.176Z", + "created": "2026-07-29T06:02:52.451Z", "dataset": "google_workspace.rules", "id": "1", - "ingested": "2026-07-29T04:13:33Z", + "ingested": "2026-07-29T06:02:55Z", "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "rules", diff --git a/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml index 6d44890c35e..a944e52b56c 100644 --- a/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/vault/elasticsearch/ingest_pipeline/default.yml @@ -185,9 +185,12 @@ processors: view_external_document: file source: |- ctx.event = ctx.event ?: [:]; - def category = []; - category.add(params.get(ctx.google_workspace.vault.name)); - ctx.event.category = category; + def category = params.get(ctx.google_workspace.vault.name); + if (category == null) { + ctx.event.remove('category'); + } else { + ctx.event.category = [category]; + } on_failure: - append: field: error.message @@ -287,9 +290,12 @@ processors: view_system_audit_log: access source: |- ctx.event = ctx.event ?: [:]; - def type = []; - type.add(params.get(ctx.google_workspace.vault.name)); - ctx.event.type = type; + def type = params.get(ctx.google_workspace.vault.name); + if (type == null) { + ctx.event.remove('type'); + } else { + ctx.event.type = [type]; + } on_failure: - append: field: error.message diff --git a/packages/google_workspace/data_stream/vault/sample_event.json b/packages/google_workspace/data_stream/vault/sample_event.json index 53825b82a36..35e4cd43c00 100644 --- a/packages/google_workspace/data_stream/vault/sample_event.json +++ b/packages/google_workspace/data_stream/vault/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2025-04-10T19:05:24.881Z", "agent": { - "ephemeral_id": "f655fbf2-623b-4948-a638-c1ccd743a3ef", - "id": "1be3bd34-3d99-4e8a-bcda-4ee31f491bd4", - "name": "elastic-agent-79178", + "ephemeral_id": "e1803727-09c8-4f8f-a00a-cfa7709d01d1", + "id": "92d544af-344c-4617-9be3-355dedc2955f", + "name": "elastic-agent-51926", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.vault", - "namespace": "64267", + "namespace": "16076", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "1be3bd34-3d99-4e8a-bcda-4ee31f491bd4", + "id": "92d544af-344c-4617-9be3-355dedc2955f", "snapshot": false, "version": "8.19.4" }, @@ -28,7 +28,7 @@ ], "dataset": "google_workspace.vault", "id": "1", - "ingested": "2026-07-22T07:05:48Z", + "ingested": "2026-07-29T06:04:35Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"XB4Sd9ZEYpFd-msikcPTLY7Ao7PvyP0QeR9k5OdWZ_Y/77VsZvNcux1EnUIu_SyN08-cHo8\",\"events\":{\"name\":\"view_per_matter_litigation_hold_report\",\"parameters\":[{\"name\":\"matter_id\",\"value\":\"78504485-73d5-4b01-ae1a-63ebc1ae66eb\"},{\"name\":\"resource_name\",\"value\":\"0\"},{\"name\":\"additional_details\",\"value\":\"matter_name: \\\"Demo\\\"\\n\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"vault\",\"customerId\":\"1\",\"time\":\"2025-04-10T19:05:24.881Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "vault", diff --git a/packages/google_workspace/docs/README.md b/packages/google_workspace/docs/README.md index b5a12e12076..9434a63f27d 100644 --- a/packages/google_workspace/docs/README.md +++ b/packages/google_workspace/docs/README.md @@ -524,22 +524,22 @@ An example event for `login` looks as following: { "@timestamp": "2022-05-04T15:04:05.000Z", "agent": { - "ephemeral_id": "e4048d3d-afb8-4c10-adc4-95dcd300b19e", - "id": "80a855c8-f052-4ef6-b0ca-053ae021cfa2", - "name": "elastic-agent-55461", + "ephemeral_id": "bed60d5c-4818-4532-b154-8552a207963d", + "id": "216537c1-0624-4a33-8211-e63900f3f8ea", + "name": "elastic-agent-60367", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.login", - "namespace": "86206", + "namespace": "74725", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "80a855c8-f052-4ef6-b0ca-053ae021cfa2", + "id": "216537c1-0624-4a33-8211-e63900f3f8ea", "snapshot": false, "version": "8.19.4" }, @@ -549,10 +549,10 @@ An example event for `login` looks as following: "category": [ "iam" ], - "created": "2026-07-29T04:12:29.868Z", + "created": "2026-07-29T06:00:06.077Z", "dataset": "google_workspace.login", "id": "1", - "ingested": "2026-07-29T04:12:32Z", + "ingested": "2026-07-29T06:00:09Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "login", @@ -666,22 +666,22 @@ An example event for `rules` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "f9501162-cab7-43e1-b483-818df864526f", - "id": "c3f09287-dd43-4314-8bf2-169c1e558717", - "name": "elastic-agent-92827", + "ephemeral_id": "6dd44921-df3e-4058-b8a7-f864acac8e0f", + "id": "901c8bf0-0fa4-4132-a0be-09269156a5fc", + "name": "elastic-agent-91966", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.rules", - "namespace": "26329", + "namespace": "89516", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "c3f09287-dd43-4314-8bf2-169c1e558717", + "id": "901c8bf0-0fa4-4132-a0be-09269156a5fc", "snapshot": false, "version": "8.19.4" }, @@ -691,10 +691,10 @@ An example event for `rules` looks as following: "category": [ "intrusion_detection" ], - "created": "2026-07-29T04:13:30.176Z", + "created": "2026-07-29T06:02:52.451Z", "dataset": "google_workspace.rules", "id": "1", - "ingested": "2026-07-29T04:13:33Z", + "ingested": "2026-07-29T06:02:55Z", "kind": "alert", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "rules", @@ -1771,22 +1771,22 @@ An example event for `device` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "cf7859d2-bcd3-4e91-9434-5af0f3d3f6bc", - "id": "af766712-5402-4b83-931f-6d151f49defa", - "name": "elastic-agent-99347", + "ephemeral_id": "14e1b701-1317-425c-ba20-03919fb88569", + "id": "5c4c52d8-4476-42f6-96cc-3cc0946ae3ab", + "name": "elastic-agent-10485", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.device", - "namespace": "35081", + "namespace": "25697", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "af766712-5402-4b83-931f-6d151f49defa", + "id": "5c4c52d8-4476-42f6-96cc-3cc0946ae3ab", "snapshot": false, "version": "8.19.4" }, @@ -1797,10 +1797,10 @@ An example event for `device` looks as following: "host", "package" ], - "created": "2026-07-29T04:10:28.571Z", + "created": "2026-07-29T05:55:46.418Z", "dataset": "google_workspace.device", "id": "1", - "ingested": "2026-07-29T04:10:31Z", + "ingested": "2026-07-29T05:55:49Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@foo.com\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "outcome": "failure", @@ -2644,35 +2644,38 @@ An example event for `context_aware_access` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "3a36557f-f0d1-4a59-8361-19a8609a8d7a", - "id": "65ce985f-497e-456d-b6d8-e0c0f3864a08", - "name": "elastic-agent-64228", + "ephemeral_id": "2bce9511-e030-46d7-9831-d1f283b800ea", + "id": "ffe11690-540e-4299-b8cf-e77d2ba51356", + "name": "elastic-agent-87207", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.context_aware_access", - "namespace": "65428", + "namespace": "22169", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "65ce985f-497e-456d-b6d8-e0c0f3864a08", + "id": "ffe11690-540e-4299-b8cf-e77d2ba51356", "snapshot": false, "version": "8.19.4" }, "event": { "action": "APPLICATION_EVENT", "agent_id_status": "verified", - "created": "2026-07-22T06:56:35.154Z", + "created": "2026-07-29T05:54:50.248Z", "dataset": "google_workspace.context_aware_access", "id": "1", - "ingested": "2026-07-22T06:56:38Z", + "ingested": "2026-07-29T05:54:53Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", - "provider": "device" + "provider": "device", + "type": [ + "info" + ] }, "google_workspace": { "actor": { @@ -2812,22 +2815,22 @@ An example event for `gcp` looks as following: { "@timestamp": "2020-10-02T15:00:00.000Z", "agent": { - "ephemeral_id": "e462c95e-fc7b-4e8c-8e17-c078bbd6363a", - "id": "3be6ee34-e840-4202-a088-f8cbacd473b4", - "name": "elastic-agent-95567", + "ephemeral_id": "2f60bf92-3781-4831-b19c-792f8565bbef", + "id": "25ffa2e6-eaa5-4bed-82e9-ca0ad5868dc0", + "name": "elastic-agent-57067", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.gcp", - "namespace": "98644", + "namespace": "20316", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "3be6ee34-e840-4202-a088-f8cbacd473b4", + "id": "25ffa2e6-eaa5-4bed-82e9-ca0ad5868dc0", "snapshot": false, "version": "8.19.4" }, @@ -2837,10 +2840,10 @@ An example event for `gcp` looks as following: "category": [ "iam" ], - "created": "2026-07-22T06:59:03.390Z", + "created": "2026-07-29T05:57:22.727Z", "dataset": "google_workspace.gcp", "id": "1", - "ingested": "2026-07-22T06:59:06Z", + "ingested": "2026-07-29T05:57:25Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"events\":{\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"foo@bar.com\"}],\"type\":\"CLOUD_OSLOGIN\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}", "provider": "device", @@ -2972,15 +2975,15 @@ An example event for `chrome` looks as following: { "@timestamp": "2024-12-09T14:18:25.405Z", "agent": { - "ephemeral_id": "badc7085-7c02-4c86-b76e-394e9ca1d669", - "id": "e361e869-51a3-4e11-9525-c96595319143", - "name": "elastic-agent-34701", + "ephemeral_id": "9fe95630-3cd8-4a6b-9284-34a97968419d", + "id": "fd20d16d-a4f3-4cf2-954f-302994a9b79a", + "name": "elastic-agent-84798", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chrome", - "namespace": "37207", + "namespace": "17212", "type": "logs" }, "device": { @@ -2992,7 +2995,7 @@ An example event for `chrome` looks as following: "version": "8.16.0" }, "elastic_agent": { - "id": "e361e869-51a3-4e11-9525-c96595319143", + "id": "fd20d16d-a4f3-4cf2-954f-302994a9b79a", "snapshot": false, "version": "8.19.4" }, @@ -3004,7 +3007,7 @@ An example event for `chrome` looks as following: ], "dataset": "google_workspace.chrome", "id": "-3640711002716937498", - "ingested": "2026-07-29T04:09:32Z", + "ingested": "2026-07-29T05:53:08Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"kalpesh.kumar@example.io\",\"profileId\":\"109689693170624712102\"},\"etag\":\"\\\"CfV-pEPVZc7PJf2fWsHJTliD34MdGbO8iFIk3L4uBwQ/cBsNSJx2A9Lg8kiQCGLddmq827A\\\"\",\"events\":{\"name\":\"BROWSER_EXTENSION_INSTALL\",\"parameters\":[{\"intValue\":\"1733753905405\",\"name\":\"TIMESTAMP\"},{\"name\":\"EVENT_REASON\",\"value\":\"BROWSER_EXTENSION_INSTALL\"},{\"name\":\"APP_ID\",\"value\":\"lmjegmlicamnimmfhcmpkclmigmmcbeh\"},{\"name\":\"APP_NAME\",\"value\":\"Application Launcher For Drive (by Google)\"},{\"name\":\"BROWSER_VERSION\",\"value\":\"123.0.6312.112\"},{\"name\":\"CHROME_ORG_UNIT_ID\",\"value\":\"02gajno12larrqx\"},{\"name\":\"CLIENT_TYPE\",\"value\":\"CHROME_OS_DEVICE\"},{\"name\":\"DEVICE_NAME\",\"value\":\"NXKUTSI002429051947600\"},{\"name\":\"DEVICE_PLATFORM\",\"value\":\"ChromeOS 15786.48.2\"},{\"name\":\"DEVICE_USER\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"DIRECTORY_DEVICE_ID\",\"value\":\"efa9510f-8cd2-4d85-b6c2-939cfb335e9e\"},{\"name\":\"EVENT_RESULT\",\"value\":\"REPORTED\"},{\"name\":\"EXTENSION_ACTION\",\"value\":\"INSTALL\"},{\"name\":\"EXTENSION_SOURCE\",\"value\":\"CHROME_WEBSTORE\"},{\"name\":\"EXTENSION_VERSION\",\"value\":\"3.10\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"example.io\"},{\"name\":\"PROFILE_USER_NAME\",\"value\":\"kalpesh.kumar@example.io\"},{\"name\":\"USER_AGENT\",\"value\":\"Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"},{\"name\":\"VIRTUAL_DEVICE_ID\",\"value\":\"3d69c5a5-0afc-474b-a1a3-d3dc617e2a60\"}],\"type\":\"BROWSER_EXTENSION_INSTALL_TYPE\"},\"id\":{\"applicationName\":\"chrome\",\"customerId\":\"C03puekhd\",\"time\":\"2024-12-09T14:18:25.405Z\",\"uniqueQualifier\":\"-3640711002716937498\"},\"kind\":\"admin#reports#activity\"}", "outcome": "success", @@ -3362,22 +3365,22 @@ An example event for `calendar` looks as following: { "@timestamp": "2025-04-01T07:00:40.262Z", "agent": { - "ephemeral_id": "833853f9-febd-4424-916d-902130ddaf9e", - "id": "c5aebc7f-a471-46b7-82c5-b172b336f7da", - "name": "elastic-agent-84379", + "ephemeral_id": "0bf0c46e-128f-4c5f-9ef3-be0324853874", + "id": "84d83968-c050-49a6-a9f8-d1430810bcdc", + "name": "elastic-agent-49212", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.calendar", - "namespace": "15097", + "namespace": "66608", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "c5aebc7f-a471-46b7-82c5-b172b336f7da", + "id": "84d83968-c050-49a6-a9f8-d1430810bcdc", "snapshot": false, "version": "8.19.4" }, @@ -3389,7 +3392,7 @@ An example event for `calendar` looks as following: ], "dataset": "google_workspace.calendar", "id": "1", - "ingested": "2026-07-29T04:07:36Z", + "ingested": "2026-07-29T05:49:29Z", "kind": "event", "original": "{\"actor\":{\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"delete_calendar\",\"parameters\":[{\"name\":\"calendar_id\",\"value\":\"c_abc123@group.calendar.google.com\"},{\"name\":\"api_kind\",\"value\":\"web\"},{\"name\":\"user_agent\",\"value\":\"Mozilla/5.0\"}],\"type\":\"calendar_change\"},\"id\":{\"applicationName\":\"calendar\",\"customerId\":\"1\",\"time\":\"2025-04-01T07:00:40.262Z\",\"uniqueQualifier\":\"1\"},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}", "provider": "calendar", @@ -3539,22 +3542,22 @@ An example event for `chat` looks as following: { "@timestamp": "2025-03-26T05:55:02.063Z", "agent": { - "ephemeral_id": "63e3d48f-55f0-4329-97a7-ccb77d539f2a", - "id": "8f3a240d-a025-4cfc-a3d2-0569d269a1fe", - "name": "elastic-agent-60488", + "ephemeral_id": "aaf2abc8-196a-4187-b608-1f0a3cb6d0da", + "id": "bbe3c33a-56b4-4151-a0af-5a101bfb9189", + "name": "elastic-agent-33417", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.chat", - "namespace": "13343", + "namespace": "83717", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "8f3a240d-a025-4cfc-a3d2-0569d269a1fe", + "id": "bbe3c33a-56b4-4151-a0af-5a101bfb9189", "snapshot": false, "version": "8.19.4" }, @@ -3566,7 +3569,7 @@ An example event for `chat` looks as following: ], "dataset": "google_workspace.chat", "id": "1", - "ingested": "2026-07-29T04:08:34Z", + "ingested": "2026-07-29T05:51:24Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A/\",\"events\":{\"name\":\"room_name_updated\",\"parameters\":[{\"name\":\"room_id\",\"value\":\"1\"},{\"name\":\"actor\",\"value\":\"foo@bar.com\"},{\"name\":\"room_name\",\"value\":\"TEST3\"},{\"name\":\"external_room\",\"value\":\"DISABLED\"},{\"name\":\"actor_type\",\"value\":\"NON_ADMIN\"},{\"name\":\"conversation_type\",\"value\":\"SPACE\"},{\"name\":\"conversation_ownership\",\"value\":\"INTERNALLY_OWNED\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"chat\",\"customerId\":\"1\",\"time\":\"2025-03-26T05:55:02.063Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "chat", @@ -3688,22 +3691,22 @@ An example event for `vault` looks as following: { "@timestamp": "2025-04-10T19:05:24.881Z", "agent": { - "ephemeral_id": "f655fbf2-623b-4948-a638-c1ccd743a3ef", - "id": "1be3bd34-3d99-4e8a-bcda-4ee31f491bd4", - "name": "elastic-agent-79178", + "ephemeral_id": "e1803727-09c8-4f8f-a00a-cfa7709d01d1", + "id": "92d544af-344c-4617-9be3-355dedc2955f", + "name": "elastic-agent-51926", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.vault", - "namespace": "64267", + "namespace": "16076", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "1be3bd34-3d99-4e8a-bcda-4ee31f491bd4", + "id": "92d544af-344c-4617-9be3-355dedc2955f", "snapshot": false, "version": "8.19.4" }, @@ -3715,7 +3718,7 @@ An example event for `vault` looks as following: ], "dataset": "google_workspace.vault", "id": "1", - "ingested": "2026-07-22T07:05:48Z", + "ingested": "2026-07-29T06:04:35Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"XB4Sd9ZEYpFd-msikcPTLY7Ao7PvyP0QeR9k5OdWZ_Y/77VsZvNcux1EnUIu_SyN08-cHo8\",\"events\":{\"name\":\"view_per_matter_litigation_hold_report\",\"parameters\":[{\"name\":\"matter_id\",\"value\":\"78504485-73d5-4b01-ae1a-63ebc1ae66eb\"},{\"name\":\"resource_name\",\"value\":\"0\"},{\"name\":\"additional_details\",\"value\":\"matter_name: \\\"Demo\\\"\\n\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"vault\",\"customerId\":\"1\",\"time\":\"2025-04-10T19:05:24.881Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "vault", @@ -3837,34 +3840,31 @@ An example event for `meet` looks as following: { "@timestamp": "2025-04-11T09:23:00.703059Z", "agent": { - "ephemeral_id": "71d11372-1a72-49b3-a1a6-37b19a3f7851", - "id": "722fe293-8487-43c7-bb6e-df12f5f19e44", - "name": "elastic-agent-18911", + "ephemeral_id": "aebece6a-1925-414e-a7e3-a86ced5bac7d", + "id": "a71b149d-2a6e-4e68-9259-193c896269fb", + "name": "elastic-agent-94649", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.meet", - "namespace": "47636", + "namespace": "85335", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "722fe293-8487-43c7-bb6e-df12f5f19e44", + "id": "a71b149d-2a6e-4e68-9259-193c896269fb", "snapshot": false, "version": "8.19.4" }, "event": { "action": "invitation-sent", "agent_id_status": "verified", - "category": [ - "network" - ], "dataset": "google_workspace.meet", "id": "1", - "ingested": "2026-07-22T07:03:23Z", + "ingested": "2026-07-29T06:01:09Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A\",\"events\":{\"name\":\"invitation_sent\",\"parameters\":[{\"boolValue\":false,\"name\":\"is_external\"},{\"name\":\"meeting_code\",\"value\":\"NTBTYDTXBE\"},{\"name\":\"conference_id\",\"value\":\"-PeisjX_5iUtKPuGffkJDaBcdEfgh\"},{\"name\":\"action_time\",\"value\":\"2025-04-11T09:23:00.703059Z\"},{\"intValue\":\"1\",\"name\":\"target_user_count\"},{\"name\":\"identifier\",\"value\":\"foo@bar.com\"},{\"name\":\"identifier_type\",\"value\":\"email_address\"}],\"type\":\"conference_action\"},\"id\":{\"applicationName\":\"meet\",\"customerId\":\"1\",\"time\":\"2025-04-11T09:23:00.703Z\",\"uniqueQualifier\":\"1\"},\"kind\":\"admin#reports#activity\"}", "provider": "meet", @@ -4040,22 +4040,22 @@ An example event for `keep` looks as following: { "@timestamp": "2025-03-27T12:45:08.310Z", "agent": { - "ephemeral_id": "a1dc4da9-10b6-4671-b3d9-20f0c9558c3f", - "id": "a1731c07-db09-45af-aa19-cd51604e7136", - "name": "elastic-agent-87212", + "ephemeral_id": "6ea4e32f-5b2f-44c5-94a1-eb8f3a056d96", + "id": "f2e914a5-6687-4f3d-8e76-23a4996e4b93", + "name": "elastic-agent-26560", "type": "filebeat", "version": "8.19.4" }, "data_stream": { "dataset": "google_workspace.keep", - "namespace": "60175", + "namespace": "43435", "type": "logs" }, "ecs": { "version": "8.16.0" }, "elastic_agent": { - "id": "a1731c07-db09-45af-aa19-cd51604e7136", + "id": "f2e914a5-6687-4f3d-8e76-23a4996e4b93", "snapshot": false, "version": "8.19.4" }, @@ -4067,7 +4067,7 @@ An example event for `keep` looks as following: ], "dataset": "google_workspace.keep", "id": "0", - "ingested": "2026-07-22T07:00:49Z", + "ingested": "2026-07-29T05:59:04Z", "kind": "event", "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":\"1\"},\"etag\":\"abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU\",\"events\":{\"name\":\"uploaded_attachment\",\"parameters\":[{\"name\":\"owner_email\",\"value\":\"foo@bar.com\"},{\"name\":\"note_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz\"},{\"name\":\"attachment_name\",\"value\":\"https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh\"}],\"type\":\"user_action\"},\"id\":{\"applicationName\":\"keep\",\"customerId\":\"1\",\"time\":\"2025-03-27T12:45:08.310Z\",\"uniqueQualifier\":\"0\"},\"kind\":\"admin#reports#activity\"}", "provider": "keep", From e8830e388ff69f265b30ca43306251d2638a67ae Mon Sep 17 00:00:00 2001 From: Brijesh Khunt Date: Fri, 31 Jul 2026 12:58:29 +0530 Subject: [PATCH 9/9] add event.reason ECS field in github.issues data stream --- packages/github/changelog.yml | 2 +- .../test/pipeline/test-github-issues-json.log-expected.json | 1 + .../issues/elasticsearch/ingest_pipeline/default.yml | 5 +++++ packages/github/data_stream/issues/sample_event.json | 1 + packages/github/docs/README.md | 1 + 5 files changed, 9 insertions(+), 1 deletion(-) diff --git a/packages/github/changelog.yml b/packages/github/changelog.yml index ed0892d7400..ca5dad09694 100644 --- a/packages/github/changelog.yml +++ b/packages/github/changelog.yml @@ -1,7 +1,7 @@ # newer versions go on top - version: "2.25.2" changes: - - description: Add `event.action` to the `issues` data stream. + - description: Add `event.action` and `event.reason` to the `issues` data stream. type: bugfix link: https://github.com/elastic/integrations/pull/20276 - version: "2.25.1" diff --git a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json index e97d39db933..f0f07f62c9b 100644 --- a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json +++ b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json @@ -10,6 +10,7 @@ "created": "2011-04-22T13:33:48.000Z", "kind": "event", "original": "{\"id\":1,\"node_id\":\"MDU6SXNzdWUx\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"number\":1347,\"state\":\"open\",\"title\":\"Found a bug\",\"body\":\"I'm having a problem with this.\",\"user\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":true},\"labels\":[{\"id\":208045946,\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\",\"name\":\"bug\",\"description\":\"Something isn't working\",\"color\":\"f29513\",\"default\":true}],\"assignee\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"assignees\":[{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false}],\"milestone\":{\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"id\":1002604,\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"state\":\"open\",\"title\":\"v1.0\",\"description\":\"Tracking milestone for version 1.0\",\"creator\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"open_issues\":4,\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"closed_at\":\"2013-02-12T13:22:01Z\",\"due_on\":\"2012-10-09T23:39:01Z\"},\"locked\":true,\"active_lock_reason\":\"too heated\",\"comments\":0,\"pull_request\":{\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\"},\"closed_at\":null,\"created_at\":\"2011-04-22T13:33:48Z\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"closed_by\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"repository\": {\"id\":1296269,\"node_id\":\"MDEwOlJlcG9zaXRvcnkxMjk2MjY5\",\"name\":\"Hello-World\",\"full_name\":\"octocat/Hello-World\",\"owner\":{\"login\":\"octocat\",\"id\":1,\"node_id\":\"MDQ6VXNlcjE=\",\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/octocat\",\"html_url\":\"https://github.com/octocat\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"type\":\"User\",\"site_admin\":false},\"private\":false,\"html_url\":\"https://github.com/octocat/Hello-World\",\"description\":\"This your first repo!\",\"fork\":false,\"url\":\"https://api.github.com/repos/octocat/Hello-World\",\"archive_url\":\"https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}\",\"assignees_url\":\"https://api.github.com/repos/octocat/Hello-World/assignees{/user}\",\"blobs_url\":\"https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}\",\"branches_url\":\"https://api.github.com/repos/octocat/Hello-World/branches{/branch}\",\"collaborators_url\":\"https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}\",\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/comments{/number}\",\"commits_url\":\"https://api.github.com/repos/octocat/Hello-World/commits{/sha}\",\"compare_url\":\"https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}\",\"contents_url\":\"https://api.github.com/repos/octocat/Hello-World/contents/{+path}\",\"contributors_url\":\"https://api.github.com/repos/octocat/Hello-World/contributors\",\"deployments_url\":\"https://api.github.com/repos/octocat/Hello-World/deployments\",\"downloads_url\":\"https://api.github.com/repos/octocat/Hello-World/downloads\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/events\",\"forks_url\":\"https://api.github.com/repos/octocat/Hello-World/forks\",\"git_commits_url\":\"https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}\",\"git_refs_url\":\"https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}\",\"git_tags_url\":\"https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}\",\"git_url\":\"git:github.com/octocat/Hello-World.git\",\"issue_comment_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}\",\"issue_events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/events{/number}\",\"issues_url\":\"https://api.github.com/repos/octocat/Hello-World/issues{/number}\",\"keys_url\":\"https://api.github.com/repos/octocat/Hello-World/keys{/key_id}\",\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/labels{/name}\",\"languages_url\":\"https://api.github.com/repos/octocat/Hello-World/languages\",\"merges_url\":\"https://api.github.com/repos/octocat/Hello-World/merges\",\"milestones_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones{/number}\",\"notifications_url\":\"https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}\",\"pulls_url\":\"https://api.github.com/repos/octocat/Hello-World/pulls{/number}\",\"releases_url\":\"https://api.github.com/repos/octocat/Hello-World/releases{/id}\",\"ssh_url\":\"git@github.com:octocat/Hello-World.git\",\"stargazers_url\":\"https://api.github.com/repos/octocat/Hello-World/stargazers\",\"statuses_url\":\"https://api.github.com/repos/octocat/Hello-World/statuses/{sha}\",\"subscribers_url\":\"https://api.github.com/repos/octocat/Hello-World/subscribers\",\"subscription_url\":\"https://api.github.com/repos/octocat/Hello-World/subscription\",\"tags_url\":\"https://api.github.com/repos/octocat/Hello-World/tags\",\"teams_url\":\"https://api.github.com/repos/octocat/Hello-World/teams\",\"trees_url\":\"https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}\",\"clone_url\":\"https://github.com/octocat/Hello-World.git\",\"mirror_url\":\"git:git.example.com/octocat/Hello-World\",\"hooks_url\":\"https://api.github.com/repos/octocat/Hello-World/hooks\",\"svn_url\":\"https://svn.github.com/octocat/Hello-World\",\"homepage\":\"https://github.com\",\"language\":null,\"forks_count\":9,\"stargazers_count\":80,\"watchers_count\":80,\"size\":108,\"default_branch\":\"master\",\"open_issues_count\":0,\"is_template\":true,\"topics\":[\"octocat\",\"atom\",\"electron\",\"api\"],\"has_issues\":true,\"has_projects\":true,\"has_wiki\":true,\"has_pages\":false,\"has_downloads\":true,\"archived\":false,\"disabled\":false,\"visibility\":\"public\",\"pushed_at\":\"2011-01-26T19:06:43Z\",\"created_at\":\"2011-01-26T19:01:12Z\",\"updated_at\":\"2011-01-26T19:14:43Z\",\"permissions\":{\"admin\":false,\"push\":false,\"pull\":true},\"allow_rebase_merge\":true,\"template_repository\":null,\"temp_clone_token\":\"ABTLWHOULUVAXGTRYU7OC2876QJ2O\",\"allow_squash_merge\":true,\"allow_auto_merge\":false,\"delete_branch_on_merge\":true,\"allow_merge_commit\":true,\"subscribers_count\":42,\"network_count\":0,\"license\":{\"key\":\"mit\",\"name\":\"MIT License\",\"url\":\"https://api.github.com/licenses/mit\",\"spdx_id\":\"MIT\",\"node_id\":\"MDc6TGljZW5zZW1pdA==\",\"html_url\":\"https://github.com/licenses/mit\"},\"forks\":1,\"open_issues\":1,\"watchers\":1},\"author_association\":\"COLLABORATOR\",\"state_reason\":\"completed\"}", + "reason": "completed", "type": [ "creation" ] diff --git a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml index d9b9e2bdc6b..5123af5a37b 100644 --- a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml @@ -58,6 +58,11 @@ processors: value: closed tag: set_event_action_closed if: ctx.github?.issues?.state == 'closed' + - set: + field: event.reason + copy_from: github.issues.state_reason + tag: set_event_reason_from_state_reason + ignore_empty_value: true - date: field: github.issues.updated_at formats: diff --git a/packages/github/data_stream/issues/sample_event.json b/packages/github/data_stream/issues/sample_event.json index 0ea4abee71c..f778f5a66b8 100644 --- a/packages/github/data_stream/issues/sample_event.json +++ b/packages/github/data_stream/issues/sample_event.json @@ -28,6 +28,7 @@ "ingested": "2026-07-29T03:53:27Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", + "reason": "completed", "type": [ "creation" ] diff --git a/packages/github/docs/README.md b/packages/github/docs/README.md index f47b7549e6c..0292e2adef0 100644 --- a/packages/github/docs/README.md +++ b/packages/github/docs/README.md @@ -984,6 +984,7 @@ An example event for `issues` looks as following: "ingested": "2026-07-29T03:53:27Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}", + "reason": "completed", "type": [ "creation" ]