Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Upgrade packages to ECS 8.2 (1/4) #2778

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
taylor-swanson merged 28 commits into from
Apr 25, 2022
Merged

Upgrade packages to ECS 8.2 (1/4) #2778

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
43d80af
Update 1password to ECS 8.2
taylor-swanson Feb 22, 2022
acecb9a
Update akamai to ECS 8.2
taylor-swanson Feb 22, 2022
7016b47
Update atlassian_bitbucket to ECS 8.2
taylor-swanson Feb 22, 2022
54c2b3b
Update atlassian_confluence to ECS 8.2
taylor-swanson Feb 22, 2022
f8279b8
Update atlassian_jira to ECS 8.2
taylor-swanson Feb 22, 2022
3194d8e
Update auditd to ECS 8.2
taylor-swanson Feb 22, 2022
041501d
Update barracuda to ECS 8.2
taylor-swanson Feb 22, 2022
cc7c89b
Update bluecoat to ECS 8.2
taylor-swanson Feb 22, 2022
56172ec
Update carbonblack_edr to ECS 8.2
taylor-swanson Feb 22, 2022
213498a
Update cisco_asa to ECS 8.2
taylor-swanson Feb 22, 2022
ecc1bf2
Update cisco_duo to ECS 8.2
taylor-swanson Feb 22, 2022
27ae1d3
Update cisco_ftd to ECS 8.2
taylor-swanson Feb 22, 2022
5f38202
Update cisco_ios to ECS 8.2
taylor-swanson Feb 23, 2022
3761a98
Update cisco_meraki to ECS 8.2
taylor-swanson Feb 23, 2022
81ee028
Update cisco_nexus to ECS 8.2
taylor-swanson Feb 23, 2022
9821c1a
Update cisco_secure_endpoint to ECS 8.2
taylor-swanson Feb 23, 2022
821dcf4
Update cisco_umbrella to ECS 8.2
taylor-swanson Feb 23, 2022
05aa725
Update changelogs with PR number
taylor-swanson Mar 7, 2022
9748151
Remove event.ingested from packages
taylor-swanson Mar 16, 2022
320cac2
Merge branch 'main' into ecs8.2-part1
taylor-swanson Mar 16, 2022
6f4bb5d
Make akamai version change be minor, fix quotes
taylor-swanson Mar 16, 2022
9c39deb
Merge branch 'main' into ecs8.2-part1
taylor-swanson Apr 5, 2022
177071c
Clean up manifest after merge
taylor-swanson Apr 5, 2022
45da561
Fix cisco_ftd changelog
taylor-swanson Apr 5, 2022
ab8b9ef
Regen files after merge
taylor-swanson Apr 5, 2022
8bd9a9f
Merge branch 'main' into ecs8.2-part1
taylor-swanson Apr 21, 2022
2922bf2
Merge branch 'main' into ecs8.2-part1
taylor-swanson Apr 21, 2022
484cb55
Merge branch 'main' into ecs8.2-part1
taylor-swanson Apr 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/1password/_dev/build/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
dependencies:
ecs:
reference: git@8.0
reference: git@8.2
5 changes: 5 additions & 0 deletions packages/1password/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.3.0"
changes:
- description: Update to ECS 8.2
type: enhancement
link: https://github.com/elastic/integrations/pull/2778
- version: "1.2.2"
changes:
- description: Fix typo in config template for ignoring host enrichment
Expand Down
4 changes: 2 additions & 2 deletions ...s/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
{
"@timestamp": "2021-08-30T18:57:42.484Z",
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"event": {
"action": "reveal",
Expand Down Expand Up @@ -76,7 +76,7 @@
{
"@timestamp": "2021-08-30T19:10:00.123Z",
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"event": {
"category": [
Expand Down
2 changes: 1 addition & 1 deletion packages/1password/data_stream/item_usages/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ processors:
#######################
- set:
field: ecs.version
value: "8.0.0"
value: "8.2.0"
# Sets event.created from the @timestamp field generated by filebeat before being overwritten further down
- set:
field: event.created
Expand Down
2 changes: 1 addition & 1 deletion packages/1password/data_stream/item_usages/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
"type": "logs"
},
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"elastic_agent": {
"id": "8652330e-4de6-4596-a16f-4463a6c56e9e",
Expand Down
4 changes: 2 additions & 2 deletions ...ord/data_stream/signin_attempts/_dev/test/pipeline/test-signinattempts.json-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
{
"@timestamp": "2021-08-11T14:28:03.000Z",
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"event": {
"action": "success",
Expand Down Expand Up @@ -78,7 +78,7 @@
{
"@timestamp": "2021-08-11T15:04:22.000Z",
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"event": {
"action": "credentials_failed",
Expand Down
2 changes: 1 addition & 1 deletion packages/1password/data_stream/signin_attempts/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ processors:
#######################
- set:
field: ecs.version
value: "8.0.0"
value: "8.2.0"
# Sets event.created from the @timestamp field generated by filebeat before being overwritten further down
- set:
field: event.created
Expand Down
2 changes: 1 addition & 1 deletion packages/1password/data_stream/signin_attempts/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
"type": "logs"
},
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"elastic_agent": {
"id": "8652330e-4de6-4596-a16f-4463a6c56e9e",
Expand Down
4 changes: 2 additions & 2 deletions packages/1password/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ An example event for `signin_attempts` looks as following:
"type": "logs"
},
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"elastic_agent": {
"id": "8652330e-4de6-4596-a16f-4463a6c56e9e",
Expand Down Expand Up @@ -232,7 +232,7 @@ An example event for `item_usages` looks as following:
"type": "logs"
},
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"elastic_agent": {
"id": "8652330e-4de6-4596-a16f-4463a6c56e9e",
Expand Down
2 changes: 1 addition & 1 deletion packages/1password/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 1.0.0
name: 1password
title: "1Password Events Reporting"
version: 1.2.2
version: 1.3.0
license: basic
description: Collect events from 1Password Events API with Elastic Agent.
type: integration
Expand Down
2 changes: 1 addition & 1 deletion packages/akamai/_dev/build/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
dependencies:
ecs:
reference: git@8.0
reference: git@8.2
5 changes: 5 additions & 0 deletions packages/akamai/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "0.2.0"
changes:
- description: Update to ECS 8.2
type: enhancement
link: https://github.com/elastic/integrations/pull/2778
- version: "0.1.3"
changes:
- description: Fix typo in config template for ignoring host enrichment
Expand Down
6 changes: 2 additions & 4 deletions packages/akamai/data_stream/siem/_dev/test/pipeline/test-http-json.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@
},
"@timestamp": "2017-04-04T10:57:02.000Z",
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"related": {
"ip": [
Expand Down Expand Up @@ -159,7 +159,6 @@
},
"event": {
"start": "2017-04-04T10:57:02.000Z",
"ingested": "2021-12-23T23:43:19.592965333Z",
"original": "{\"format\":\"json\",\"type\":\"akamai_siem\",\"version\":\"1.0\",\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"14227\",\"policyId\":\"qik1_26545\",\"ruleActions\":\"YWxlcnQ%3d%3bYWxlcnQ%3d%3bZGVueQ%3d%3d\",\"ruleData\":\"dGVsbmV0LmV4ZQ%3d%3d%3bdGVsbmV0LmV4ZQ%3d%3d%3bVmVjdG9yIFNjb3JlOiAxMCwgREVOWSB0aHJlc2hvbGQ6IDksIEFsZX \",\"ruleMessages\":\"U3lzdGVtIENvbW1hbmQgQWNjZXNz%3bU3lzdGVtIENvbW1hbmQgSW5qZWN0aW9u%3bQW5vbWFseSBTY29yZSBFeGNlZWRlZCBmb3 \",\"ruleSelectors\":\"QVJHUzpvcHRpb24%3d%3bQVJHUzpvcHRpb24%3d%3b\",\"ruleTags\":\"T1dBU1BfQ1JTL1dFQl9BVFRBQ0svRklMRV9JTkpFQ1RJT04%3d%3bT1dBU1BfQ1JTL1dFQl9BVFRBQ0svQ09NTUFORF9JTkpFQ1R \",\"ruleVersions\":\"NA%3d%3d%3bNA%3d%3d%3bMQ%3d%3d\",\"rules\":\"OTUwMDAy%3bOTUwMDA2%3bQ01ELUlOSkVDVElPTi1BTk9NQUxZ\"},\"geo\":{\"asn\":\"14618\",\"city\":\"ASHBURN\",\"continent\":\"288\",\"country\":\"US\",\"regionCode\":\"VA\"},\"httpMessage\":{\"bytes\":\"266\",\"host\":\"www.hmapi.com\",\"method\":\"GET\",\"path\":\"/\",\"port\":\"80\",\"protocol\":\"HTTP/1.1\",\"query\":\"option=com_jce%20telnet.exe\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"1158db1758e37bfe67b7c09\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml%0d%0aContent-Length%3a%20150\",\"start\":\"1491303422\",\"status\":\"200\"},\"userRiskData\":{\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\",\"status\":\"0\",\"score\":\"75\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"trust\":\"ugp:US\",\"general\":\"duc_1h:10|duc_1d:30\",\"allow\":\"0\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"}}",
"id": "1158db1758e37bfe67b7c09",
"category": "network",
Expand Down Expand Up @@ -273,7 +272,7 @@
},
"@timestamp": "2016-08-11T13:45:33.026Z",
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"related": {
"ip": [
Expand Down Expand Up @@ -319,7 +318,6 @@
},
"event": {
"start": "2016-08-11T13:45:33.026Z",
"ingested": "2021-12-23T23:43:19.592973640Z",
"original": "{\"format\":\"json\",\"type\":\"akamai_siem\",\"version\":\"1.0\",\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"6724\",\"policyId\":\"scoe_5426\",\"ruleActions\":\"QUxFUlQ;REVOWQ==\",\"ruleData\":\"YWxlcnQo;Y3VybA==\",\"ruleMessages\":\"Q3Jvc3Mtc2l0ZSBTY3 JpcHRpbmcgKFhTUykgQXR0YWNr; UmVxdWVzdCBJbmRpY2F0ZXMgYW4 gYXV0b21hdGVkIHByb2 dyYW0gZXhwbG9yZWQgdGhlIHNpdGU=\",\"ruleSelectors\":\"QVJHUzph;UkVRVUVTVF9IRU FERVJTOlVzZXItQWdlbnQ=\",\"ruleTags\":\"V0VCX0FUVEFDSy9YU1M=;QV VUT01BVElPTi9NSVND\",\"ruleVersions\":\";\",\"rules\":\"OTUwMDA0;OTkwMDEx\"},\"geo\":{\"asn\":\"12271\",\"city\":\"NEWYORK\",\"continent\":\"NA\",\"country\":\"US\",\"regionCode\":\"NY\"},\"httpMessage\":{\"bytes\":\"34523\",\"host\":\"www.example.com\",\"method\":\"POST\",\"path\":\"/examples/1/\",\"port\":\"80\",\"protocol\":\"http/2\",\"query\":\"a%3D..%2F..%2F..%2Fetc%2Fpasswd\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"2ab418ac8515f33\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml\",\"start\":\"1470923133.026\",\"status\":\"301\",\"tls\": \"TLSv1.2\"},\"userRiskData\":{\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\",\"status\":\"0\",\"score\":\"75\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"trust\":\"ugp:US\",\"general\":\"duc_1h:10|duc_1d:30\",\"allow\":\"0\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"}}",
"id": "2ab418ac8515f33",
"category": "network",
Expand Down
5 changes: 1 addition & 4 deletions packages/akamai/data_stream/siem/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,9 @@
---
description: Pipeline for parsing Akamai logs
processors:
- set:
field: event.ingested
value: '{{_ingest.timestamp}}'
- set:
field: ecs.version
value: '8.0.0'
value: '8.2.0'
- rename:
field: message
target_field: event.original
Expand Down
2 changes: 1 addition & 1 deletion packages/akamai/data_stream/siem/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@
"type": "logs"
},
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"elastic_agent": {
"id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7",
Expand Down
2 changes: 1 addition & 1 deletion packages/akamai/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,7 @@ An example event for `siem` looks as following:
"type": "logs"
},
"ecs": {
"version": "8.0.0"
"version": "8.2.0"
},
"elastic_agent": {
"id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7",
Expand Down
2 changes: 1 addition & 1 deletion packages/akamai/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: akamai
title: Akamai
version: 0.1.3
version: 0.2.0
release: beta
description: Akamai Integration
type: integration
Expand Down
2 changes: 1 addition & 1 deletion packages/atlassian_bitbucket/_dev/build/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
dependencies:
ecs:
reference: git@8.0
reference: git@8.2
5 changes: 5 additions & 0 deletions packages/atlassian_bitbucket/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.2.0"
changes:
- description: Update to ECS 8.2
type: enhancement
link: https://github.com/elastic/integrations/pull/2778
- version: "1.1.1"
changes:
- description: Add documentation for multi-fields
Expand Down
Loading