diff --git a/packages/checkpoint/changelog.yml b/packages/checkpoint/changelog.yml index 15325d26f2c..86160c1cadb 100644 --- a/packages/checkpoint/changelog.yml +++ b/packages/checkpoint/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.49.0" + changes: + - description: Fix missing ECS categorization for firewall drop and threat prevention events where checkpoint.rule_action is absent by falling back to checkpoint.action to set event.type, event.kind, event.outcome, and event.category. + type: enhancement + link: https://github.com/elastic/integrations/pull/20341 - version: "1.48.0" changes: - description: Improve handling of different user formats in logs. diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json index a90f393ceb7..4b33d480d94 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json @@ -108,8 +108,13 @@ "id": "{0x60928f1d,0x8,0x40de101f,0xfcdbb197}", "kind": "event", "original": "<134>1 2021-05-05T12:27:09Z cp-m CheckPoint 1231 - [action:\"Drop\"; flags:\"278528\"; ifdir:\"inbound\"; ifname:\"bond1.3999\"; loguid:\"{0x60928f1d,0x8,0x40de101f,0xfcdbb197}\"; origin:\"127.0.0.1\"; originsicname:\"CN=CP,O=cp.com.9jjkfo\"; sequencenum:\"62\"; time:\"1620217629\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={F6212FB3-54CE-6344-9164-B224119E2B92};mgmt=cp-m;date=1620031791;policy_name=CP-Cluster]\"; action_reason:\"Dropped by multiportal infrastructure\"; dst:\"81.2.69.144\"; product:\"VPN & FireWall\"; proto:\"6\"; s_port:\"52780\"; service:\"80\"; src:\"81.2.69.144\"]", + "outcome": "success", "sequence": 62, - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "connection", + "denied" + ] }, "network": { "direction": "inbound", diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json index d6a567e6b17..09202ad1636 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json @@ -1077,8 +1077,13 @@ "id": "{0x5e818e17,0x0,0x6401a8c0,0x108620ab}", "kind": "event", "original": "<134>1 2020-03-30T06:13:42Z gw-da58d3 CheckPoint 8363 - [action:\"Drop\"; flags:\"425984\"; ifdir:\"outbound\"; ifname:\"eth0\"; logid:\"1\"; loguid:\"{0x5e818e17,0x0,0x6401a8c0,0x108620ab}\"; origin:\"192.168.1.100\"; originsicname:\"cn=cp_mgmt,o=gw-da58d3..tmn8s8\"; sequencenum:\"1\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1585502566;policy_name=Standard\\]\"; dst:\"81.2.69.144\"; product:\"VPN-1 & FireWall-1\"; proto:\"6\"; s_port:\"65488\"; service:\"80\"; src:\"192.168.1.100\"; tcp_flags:\"FIN-ACK\"; tcp_packet_out_of_state:\"First packet isn't SYN\"]", + "outcome": "success", "sequence": 1, - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "connection", + "denied" + ] }, "network": { "direction": "outbound", @@ -2320,13 +2325,19 @@ "event": { "action": "Prevent", "category": [ - "network" + "network", + "intrusion_detection" ], "id": "{0xae027eed,0xef89f5a0,0x5b806530,0x8b665bef}", - "kind": "event", + "kind": "alert", "original": "<134>1 2025-01-21T09:36:10Z TEST_HOSTNAME CheckPoint 16953 - [action:\"Prevent\"; flags:\"313600\"; ifdir:\"outbound\"; ifname:\"eth3-01\"; loguid:\"{0xae027eed,0xef89f5a0,0x5b806530,0x8b665bef}\"; origin:\"192.168.1.102\"; originsicname:\"CN=TESTWA022B001,O=TESTWM002001..t2z5yx\"; sequencenum:\"2\"; time:\"1737452170\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={C09DCBFA-7A2D-3C4C-AED3-92799BF04FA4};mgmt=TEST_HOSTNAME;date=1737129819;policy_name=TEST_Policy]\"; dst:\"192.168.5.152\"; http_host:\"192.168.32.48\"; log_id:\"2\"; malware_rule_id:\"{313A7B1F-5FB8-4608-B0F8-05A2311B6FFF}\"; method:\"GET\"; policy:\"TEST_Policy\"; policy_time:\"1737409154\"; product:\"SmartDefense\"; proto:\"6\"; proxy_src_ip:\"192.168.211.208\"; reject_id_kid:\"678f6a8a-30000-48715ce7-e71d8eea\"; resource:\"http://192.168.32.48/manager/html\"; rule_name:\"ITP-1402-3\"; rule_uid:\"e497b418-91b9-4514-b784-4809e3d5dbc2\"; s_port:\"35428\"; ser_agent_kid:\"Other: Mozilla/5.0 zgrab/0.x\"; service:\"80\"; session_id:\"{0x678f6a8a,0x30001,0x48715ce7,0xe71d8eea}\"; smartdefense_profile:\"Optimized\"; src:\"192.168.211.208\"; layer_uuid:\"{31A46FFD-A526-4318-BA17-49CBCDC38A14}\"; malware_rule_id:\"{313A7B1F-5FB8-4608-B0F8-05A2311B6FFF}\"; smartdefense_profile:\"Optimized\"]", + "outcome": "success", "sequence": 2, - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "connection", + "denied" + ] }, "http": { "request": { @@ -2562,8 +2573,13 @@ "id": "{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}", "kind": "event", "original": "<134>1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 8363 - [action:\"Reject\"; flags:\"44676\"; ifdir:\"inbound\"; ifname:\"daemon\"; loguid:\"{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}\"; origin:\"192.168.0.1\"; originsicname:\"CN=cp_mgmt,O=gw-da58d3..tmn8s8\"; sequencenum:\"22\"; time:\"1746521905\"; version:\"5\"; dst:\"0.0.0.0\"; encryption_failure::\"no response from peer.\"; fw_subproduct:\"VPN-1\"; peer_gateway:\"192.168.10.1\"; proto:\"0\"; reject_category:\"IKE failure\"; rule:\"0\"; s_port:\"0\"; scheme::\"IKE\"; service:\"0\"; src:\"0.0.0.0\"; vpn_feature_name:\"IKE\"]", + "outcome": "success", "sequence": 22, - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "connection", + "denied" + ] }, "network": { "direction": "inbound", @@ -2621,10 +2637,11 @@ "event": { "action": "Detect", "category": [ - "network" + "network", + "intrusion_detection" ], "id": "{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}", - "kind": "event", + "kind": "alert", "original": "<134>1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 8363 - [action:\"Detect\"; flags:\"44676\"; ifdir:\"inbound\"; ifname:\"eth0\"; loguid:\"{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}\"; origin:\"192.168.0.1\"; originsicname:\"CN=cp_mgmt,O=gw-da58d3..tmn8s8\"; sequencenum:\"22\"; time:\"1746491278\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1746456871;policy_name=Standard\\]\"; attack:\"Port Scan\"; attack_info:\"Host Port Scan\"; confidence_level:\"5\"; dst:\"192.168.10.1\"; performance_impact:\"2\"; product:\"SmartDefense\"; protection_id:\"HostPortScan\"; protection_name:\"Host Port Scan\"; protection_type:\"anomaly\"; proto:\"4294967295\"; s_port:\"0\"; service:\"4294967295\"; severity:\"1\"; smartdefense_profile:\"Standard\"; source:\"Distinct\"; src:\"192.168.12.1\"]", "sequence": 22, "severity": 1, diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-packet-drop.log b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-packet-drop.log index ce0574a90c0..be52cb4f239 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-packet-drop.log +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-packet-drop.log @@ -2,3 +2,4 @@ <134>1 2025-01-21T09:37:10Z TEST_HOSTNAME CheckPoint 16953 - [action:"Drop"; flags:"409600"; ifdir:"inbound"; logid:"0"; loguid:"{0x5e818e17,0x1,0x6401a8c0,0x108620ab}"; origin:"192.168.1.100"; originsicname:"cn=cp_mgmt,o=gw-da58d3..tmn8s8"; sequencenum:"2"; time:"1737452230"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1585502566;policy_name=Standard\]"; drop_reason:"matched optimized drop"; layer_name:"Network"; layer_uuid:"63b7fe60-76d2-4287-bca5-21af87337b0a"; match_id:"1"; parent_rule:"0"; rule_action:"Drop"; rule_name:"Cleanup rule"; rule_uid:"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2"; packet_amount:"3"; packets:" <81.2.69.142,45000,81.2.69.144,443,6> <81.2.69.142,45001,89.160.20.128,80,17> <81.2.69.142,45002,81.2.69.144,8080,6>"] <134>1 2025-11-19T01:36:02Z TEST_HOSTNAME CheckPoint 16953 - [action:"Drop"; flags:"409600"; ifdir:"inbound"; logid:"0"; loguid:"{0x1816caef, 0x1,0x6401a8c0,0x108620ab}"; origin:"192.168.1.100"; originsicname:"CN=fw,O=fmmt.domain.com.tmn8s8"; sequencenum:"3"; time:"1763516162"; version:"5"; packet_amount:"5"; packets:"(sample only) <81.2.69.142,59912,81.2.69.144,1990,6;bond12> <81.2.69.142,40252,81.2.69.144,999,6;bond12> <81.2.69.142,60636,89.160.20.128,999,6;bond12> <81.2.69.142,43010,89.160.20.128,1898,6;bond12> <81.2.69.142,59440,81.2.69.144,1898,6;bond12>";] <134>1 2025-03-31T09:45:12Z FW-RANDOM CheckPoint 98765 - [action:"Drop"; flags:"409600"; ifdir:"inbound"; logid:"0"; loguid:"{0xa1b2c3d4,0xe5f67890,0x12345678,0xabcdef12}"; origin:"192.168.45.23"; originsicname:"CN=FWSC-RANDOM,O=TMUK_SDMZ_RANDOM.oam.example.com.abcd12"; sequencenum:"112"; time:"1743414312"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={F1234567-89AB-CDEF-0123-456789ABCDEF};mgmt=TMUK_SDMZ_RANDOM;date=1742477474;policy_name=Standard\\]"; drop_reason:"matched optimized drop"; layer_name:"Network"; layer_uuid:"123e4567-e89b-12d3-a456-426614174000"; match_id:"8"; parent_rule:"0"; rule_action:"Drop"; rule_uid:"abcdef12-3456-7890-abcd-ef1234567890"; packet_amount:"5"; packets:" <203.0.113.45,54321,198.51.100.23,12345,6;bond1.3> <203.0.113.46,23456,198.51.100.24,34567,6;bond1.3> <203.0.113.47,45678,198.51.100.25,56789,6;bond1.3> <203.0.113.48,67890,198.51.100.26,78901,6;bond1.3> <203.0.113.49,89012,198.51.100.27,90123,6;bond1.3>"; product:"VPN-1 & FireWall-1"; proto:"6"] +<134>1 2026-03-31T06:49:33.170Z TEST_HOSTNAME CheckPoint 31085 - [action:"Drop"; flags:"393216"; ifdir:"inbound"; ifname:"bond1.992"; logid:"1"; loguid:"{0xd82800ab,0xca,0xb384aa9a,0x3331928d}"; origin:"192.168.8.200"; originsicname:"CN=fw,O=example..sdf7da"; sequencenum:"1342"; time:"1743414973170"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={8383ADC5llll0-744C-80D1-6915514EFAD5};mgmt=example;date=1743403451;policy_name=example8\]"; dst:"81.2.69.144"; product:"VPN-1 & FireWall-1"; proto:"6"; s_port:"5223"; service:"49689"; src:"81.2.69.142"; tcp_flags:"ACK"; tcp_packet_out_of_state:"First packet isn't SYN"] diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-packet-drop.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-packet-drop.log-expected.json index d954a97d71f..06a8f97afcf 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-packet-drop.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-packet-drop.log-expected.json @@ -338,8 +338,13 @@ "id": "{0x1816caef, 0x1,0x6401a8c0,0x108620ab}", "kind": "event", "original": "<134>1 2025-11-19T01:36:02Z TEST_HOSTNAME CheckPoint 16953 - [action:\"Drop\"; flags:\"409600\"; ifdir:\"inbound\"; logid:\"0\"; loguid:\"{0x1816caef, 0x1,0x6401a8c0,0x108620ab}\"; origin:\"192.168.1.100\"; originsicname:\"CN=fw,O=fmmt.domain.com.tmn8s8\"; sequencenum:\"3\"; time:\"1763516162\"; version:\"5\"; packet_amount:\"5\"; packets:\"(sample only) <81.2.69.142,59912,81.2.69.144,1990,6;bond12> <81.2.69.142,40252,81.2.69.144,999,6;bond12> <81.2.69.142,60636,89.160.20.128,999,6;bond12> <81.2.69.142,43010,89.160.20.128,1898,6;bond12> <81.2.69.142,59440,81.2.69.144,1898,6;bond12>\";]", + "outcome": "success", "sequence": 3, - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "connection", + "denied" + ] }, "network": { "direction": "inbound", @@ -503,6 +508,96 @@ "tags": [ "preserve_original_event" ] + }, + { + "@timestamp": "2025-03-31T09:56:13.170Z", + "checkpoint": { + "logid": "1", + "origin_sic_name": "CN=fw,O=example..sdf7da", + "tcp_flags": "ACK", + "tcp_packet_out_of_state": "First packet isn't SYN" + }, + "destination": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "port": 49689 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Drop", + "category": [ + "network" + ], + "id": "{0xd82800ab,0xca,0xb384aa9a,0x3331928d}", + "kind": "event", + "original": "<134>1 2026-03-31T06:49:33.170Z TEST_HOSTNAME CheckPoint 31085 - [action:\"Drop\"; flags:\"393216\"; ifdir:\"inbound\"; ifname:\"bond1.992\"; logid:\"1\"; loguid:\"{0xd82800ab,0xca,0xb384aa9a,0x3331928d}\"; origin:\"192.168.8.200\"; originsicname:\"CN=fw,O=example..sdf7da\"; sequencenum:\"1342\"; time:\"1743414973170\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={8383ADC5llll0-744C-80D1-6915514EFAD5};mgmt=example;date=1743403451;policy_name=example8\\]\"; dst:\"81.2.69.144\"; product:\"VPN-1 & FireWall-1\"; proto:\"6\"; s_port:\"5223\"; service:\"49689\"; src:\"81.2.69.142\"; tcp_flags:\"ACK\"; tcp_packet_out_of_state:\"First packet isn't SYN\"]", + "outcome": "success", + "sequence": 1342, + "timezone": "UTC", + "type": [ + "connection", + "denied" + ] + }, + "network": { + "direction": "inbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "hostname": "fw", + "ingress": { + "interface": { + "name": "bond1.992" + } + }, + "ip": [ + "192.168.8.200" + ], + "name": "192.168.8.200", + "product": "VPN-1 & FireWall-1", + "type": "firewall", + "vendor": "Checkpoint" + }, + "related": { + "ip": [ + "81.2.69.142", + "81.2.69.144", + "192.168.8.200" + ] + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142", + "port": 5223 + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json index a0479e80065..05411705e3f 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json @@ -1144,9 +1144,14 @@ "id": "{0x291ee176,0x3488469e,0xdb759c74,0xc0134e9a}", "kind": "event", "original": "<134>1 2023-03-02T03:28:09Z gw-0b8ccd CheckPoint 15871 - [action:\"Block\"; flags:\"311552\"; ifdir:\"outbound\"; ifname:\"eth1\"; loguid:\"{0x291ee176,0x3488469e,0xdb759c74,0xc0134e9a}\"; origin:\"192.168.178.40\"; originsicname:\"cn=cp_mgmt,o=gw-0b8ccd..zx8qy7\"; sequencenum:\"1\"; time:\"1677727689\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={48483CA8-998B-2D46-BEEF-CE5DA956505D};mgmt=gw-0b8ccd;date=1677720751;policy_name=Standard\\]\"; confidence_level:\"5\"; dlp_incident_uid:\"{640017C9-0000-0001-27C5-C5E7C1878B89}\"; dst:\"81.2.69.144\"; frequency:\"1 days \"; http_host:\"sc1.checkpoint.com\"; lastupdatetime:\"1677727691\"; log_id:\"4294967295\"; malware_action:\"Communication with C&C site\"; malware_family:\"Check Point\"; malware_rule_id:\"{F50127A1-D5C9-4BAC-8C3F-2D2557E6FFAD}\"; method:\"GET\"; packet_capture_name:\"src-10.0.0.3.cap\"; packet_capture_time:\"1677727690\"; packet_capture_unique_id:\"time1677727689.id640acbe0.blade04\"; policy:\"Standard\"; policy_time:\"1677720775\"; portal_message:\"Your computer is trying to access a malicious server. It is probably infected by malware. For more information and remediation, please contact your help desk. Click here to report an incorrect classification. Activity: Communication with C&C site URL: http://sc1.checkpoint.com/za/images/threatwiki/pages/TestAntiBotBlade.html Reference: 498D79F3\"; product:\"Anti Malware\"; protection_id:\"00233CFEE\"; protection_name:\"Check Point - Testing Bot\"; protection_type:\"URL reputation\"; proto:\"6\"; proxy_src_ip:\"10.0.0.3\"; resource:\"http://sc1.checkpoint.com/za/images/threatwiki/pages/TestAntiBotBlade.html\"; s_port:\"34416\"; scope:\"10.0.0.3\"; service:\"80\"; service_id:\"http\"; session_id:\"{0x640017c9,0x1,0x27c5c5e7,0xc1878b89}\"; severity:\"2\"; smartdefense_profile:\"Optimized\"; src:\"10.0.0.3\"; layer_name:\"Standard Threat Prevention\"; layer_uuid:\"{6CC286F4-87BC-412A-B231-8C63C30D978E}\"; malware_rule_id:\"{F50127A1-D5C9-4BAC-8C3F-2D2557E6FFAD}\"; smartdefense_profile:\"Optimized\"; user_agent:\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0) Gecko/20100101 Firefox/93.0\"; usercheck:\"1\"; usercheck_confirmation_level:\"Application\"; usercheck_incident_uid:\"C9B778BF-CA91-A050-2673-53F9498D79F3\"; usercheck_interaction_name:\"Anti-Bot Blocked\"; web_client_type:\"Firefox\"]", + "outcome": "success", "sequence": 1, "severity": 2, - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "connection", + "denied" + ] }, "http": { "request": { @@ -1272,9 +1277,14 @@ "id": "{0x291ee176,0x3488469e,0xdb759c74,0xc0134e9a}", "kind": "event", "original": "<134>1 2023-03-02T03:28:09Z gw-0b8ccd CheckPoint 15871 - [action:\"Block\"; flags:\"311552\"; ifdir:\"outbound\"; ifname:\"eth1\"; loguid:\"{0x291ee176,0x3488469e,0xdb759c74,0xc0134e9a}\"; origin:\"192.168.178.40\"; originsicname:\"cn=cp_mgmt,o=gw-0b8ccd..zx8qy7\"; sequencenum:\"1\"; time:\"1677727689\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={48483CA8-998B-2D46-BEEF-CE5DA956505D};mgmt=gw-0b8ccd;date=1677720751;policy_name=Standard\\]\"; confidence_level:\"5\"; dlp_incident_uid:\"{640017C9-0000-0001-27C5-C5E7C1878B89}\"; dst:\"81.2.69.144\"; frequency:\"1 days \"; http_host:\"sc1.checkpoint.com\"; lastupdatetime:\"1677727750\"; log_id:\"2\"; malware_action:\"Communication with C&C site\"; malware_family:\"Check Point\"; malware_rule_id:\"{F50127A1-D5C9-4BAC-8C3F-2D2557E6FFAD}\"; method:\"GET\"; packet_capture_name:\"src-10.0.0.3.cap\"; packet_capture_time:\"1677727690\"; packet_capture_unique_id:\"time1677727689.id640acbe0.blade04\"; policy:\"Standard\"; policy_time:\"1677720775\"; portal_message:\"Your computer is trying to access a malicious server. It is probably infected by malware. For more information and remediation, please contact your help desk. Click here to report an incorrect classification. Activity: Communication with C&C site URL: http://sc1.checkpoint.com/za/images/threatwiki/pages/TestAntiBotBlade.html Reference: 498D79F3\"; product:\"Anti Malware\"; protection_id:\"00233CFEE\"; protection_name:\"Check Point - Testing Bot\"; protection_type:\"URL reputation\"; proto:\"6\"; proxy_src_ip:\"10.0.0.3\"; received_bytes:\"60\"; resource:\"http://sc1.checkpoint.com/za/images/threatwiki/pages/TestAntiBotBlade.html\"; s_port:\"34416\"; scope:\"10.0.0.3\"; sent_bytes:\"0\"; service:\"80\"; service_id:\"http\"; session_id:\"{0x640017c9,0x1,0x27c5c5e7,0xc1878b89}\"; severity:\"2\"; smartdefense_profile:\"Optimized\"; src:\"10.0.0.3\"; suppressed_logs:\"1\"; layer_name:\"Standard Threat Prevention\"; layer_uuid:\"{6CC286F4-87BC-412A-B231-8C63C30D978E}\"; malware_rule_id:\"{F50127A1-D5C9-4BAC-8C3F-2D2557E6FFAD}\"; smartdefense_profile:\"Optimized\"; user_agent:\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0) Gecko/20100101 Firefox/93.0\"; usercheck:\"1\"; usercheck_confirmation_level:\"Application\"; usercheck_incident_uid:\"C9B778BF-CA91-A050-2673-53F9498D79F3\"; usercheck_interaction_name:\"Anti-Bot Blocked\"; web_client_type:\"Firefox\"]", + "outcome": "success", "sequence": 1, "severity": 2, - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "connection", + "denied" + ] }, "http": { "request": { diff --git a/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml index a20b52bd309..8c2c5b6c87a 100644 --- a/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ b/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml @@ -431,7 +431,7 @@ processors: tag: set_event_kind_543e5f23 field: event.kind value: alert - if: "['Prevent', 'Detect', 'Quarantine'].contains(ctx.checkpoint?.rule_action)" + if: "['Prevent', 'Detect', 'Quarantine'].contains(ctx.checkpoint?.rule_action) || (ctx.checkpoint?.rule_action == null && ['Prevent', 'Detect', 'Quarantine'].contains(ctx.checkpoint?.action))" - set: tag: set_event_kind_31b9e9ac field: event.kind @@ -463,14 +463,14 @@ processors: tag: set_event_outcome_d309e070 field: event.outcome value: success - if: "['Drop', 'Reject', 'Block', 'Prevent'].contains(ctx.checkpoint?.rule_action)" + if: "['Drop', 'Reject', 'Block', 'Prevent'].contains(ctx.checkpoint?.rule_action) || (ctx.checkpoint?.rule_action == null && ['Drop', 'Reject', 'Block', 'Prevent'].contains(ctx.checkpoint?.action))" - append: tag: append_event_type_9006e7fa field: event.type value: - connection - denied - if: "['Drop', 'Reject', 'Block', 'Prevent'].contains(ctx.checkpoint?.rule_action)" + if: "['Drop', 'Reject', 'Block', 'Prevent'].contains(ctx.checkpoint?.rule_action) || (ctx.checkpoint?.rule_action == null && ['Drop', 'Reject', 'Block', 'Prevent'].contains(ctx.checkpoint?.action))" - append: tag: append_event_category_560dce16 field: event.category @@ -481,7 +481,7 @@ processors: tag: append_event_category_8303940f field: event.category value: intrusion_detection - if: "['Detect', 'Prevent'].contains(ctx.checkpoint?.rule_action)" + if: "['Detect', 'Prevent'].contains(ctx.checkpoint?.rule_action) || (ctx.checkpoint?.rule_action == null && ['Detect', 'Prevent'].contains(ctx.checkpoint?.action))" allow_duplicates: false - set: tag: set_event_outcome_7b0154c9 diff --git a/packages/checkpoint/manifest.yml b/packages/checkpoint/manifest.yml index 135aa9d3f79..1ab903ac623 100644 --- a/packages/checkpoint/manifest.yml +++ b/packages/checkpoint/manifest.yml @@ -1,6 +1,6 @@ name: checkpoint title: Check Point -version: "1.48.0" +version: "1.49.0" description: Collect logs from Check Point with Elastic Agent. type: integration format_version: "3.0.3"