Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Deployment and Devices integrations to ECS 8.16.0 (part 1) #12119

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
Open

Update Deployment and Devices integrations to ECS 8.16.0 (part 1) #12119

wants to merge 12 commits into from

Conversation

taylor-swanson
Copy link
Contributor

@taylor-swanson taylor-swanson commented Dec 16, 2024 •
edited
Loading

Proposed commit message

Updates the following integrations to ECS 8.16.0:

  • arista_ngfw
  • cef
  • checkpoint
  • cisco_aironet
  • cisco_asa
  • cisco_ftd
  • cisco_ios
  • cisco_ise
  • cisco_nexus
  • cisco_secure_email_gateway
  • citrix_waf

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

@taylor-swanson
[arista_ngfw] - change to ECS version [email protected]
88a15c5 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/arista_ngfw
@taylor-swanson
[cef] - change to ECS version [email protected]
8aa7450 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/cef
@taylor-swanson
[checkpoint] - change to ECS version [email protected]
b4e10ef 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/checkpoint
@taylor-swanson
[cisco_aironet] - change to ECS version [email protected]
36987da 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/cisco_aironet
@taylor-swanson
[cisco_asa] - change to ECS version [email protected]
05e6cf8 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/cisco_asa
@taylor-swanson
[cisco_ftd] - change to ECS version [email protected]
5d0541c 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/cisco_ftd
@taylor-swanson
[cisco_ios] - change to ECS version [email protected]
466f97e 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/cisco_ios
@taylor-swanson
[cisco_ise] - change to ECS version [email protected]
f17ec54 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/cisco_ise
@taylor-swanson
[cisco_nexus] - change to ECS version [email protected]
ad7c6ea 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/cisco_nexus
@taylor-swanson
[cisco_secure_email_gateway] - change to ECS version [email protected]
2885407 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/cisco_secure_email_gateway
@taylor-swanson
[citrix_waf] - change to ECS version [email protected]
6521219 
ECS version in build manifest changed from [email protected] to [email protected]. The set
ecs.version processor in pipelines was changed 8.16.0. Previously the pipeline
was setting version 8.11.0. The ecs.version in sample_event.json files was
changed to 8.16.0. Previously sample_event.json files contained 8.11.0.

[git-generate]
go run github.com/andrewkroh/go-examples/ecs-update@latest -ecs-version=8.16.0 [email protected] -pr=999999 packages/citrix_waf
@taylor-swanson taylor-swanson added enhancement New feature or request Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices] labels Dec 16, 2024
@taylor-swanson taylor-swanson self-assigned this Dec 16, 2024
@taylor-swanson taylor-swanson mentioned this pull request Dec 16, 2024
Open
@elastic-vault-github-plugin-prod
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@elasticmachine
Copy link

💚 Build Succeeded

cc @taylor-swanson

@taylor-swanson taylor-swanson marked this pull request as ready for review December 16, 2024 16:55
@taylor-swanson taylor-swanson requested a review from a team as a code owner December 16, 2024 16:55
@elasticmachine
Copy link

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

dwhyrock
dwhyrock reviewed Dec 17, 2024
View reviewed changes
Copy link
Contributor

@dwhyrock dwhyrock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like there's a hyperlink that needs some attention. I will approve once it's fixed.

packages/checkpoint/docs/README.md
@@ -793,5 +793,5 @@ An example event for `firewall` looks as following:
| user_agent.name | Name of the user agent. | keyword |
| user_agent.original | Unparsed user_agent string. | keyword |
| user_agent.original.text | Multi-field of `user_agent.original`. | match_only_text |
| vulnerability.id | The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] | keyword |
| vulnerability.id | The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id[Common Vulnerabilities and Exposure CVE ID]) | keyword |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't look correct in the rich diff.

Shouldn't it be something like [Common Vulnerabilities and Exposure CVE ID](https://cve.mitre.org/about/faqs.html#what_is_cve_id) ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh good catch.

Let me go check ECS, I didn't hand write that, that's pulled directly from the ECS definition (but this could also be an issue with how elastic-package is rendering the markdown).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here's the related PR: elastic/ecs#2328

The links render correctly for the ECS docs, but the syntax used for the link is not valid markdown. The integrations doc site seems to use the readme markdown more or less directly, so that will have problems, too.

For comparison, the threat fields do not use a special markup, but rather use the link directly. The ECS docs and the integration readme page in Kibana (Suricata is an example), and the integrations doc site all enrich the URL into a link. Seems like we don't need any special markup here (unless you want to hide the URL behind friendly text, but that doesn't work if it doesn't render correctly).

Unfortunately, this would need to be fixed in ECS, first. Manually fixing it here won't help, since any re-render of the readme from here will just bring the issue back. It just so happens there's an ECS meeting today. I'll bring this issue up there and see where we go from here.

@andrewkroh andrewkroh added Integration:arista_ngfw Arista NG Firewall Integration:cisco_secure_email_gateway Cisco Secure Email Gateway Integration:cef Common Event Format (CEF) Integration:cisco_ise Cisco ISE Integration:citrix_waf Citrix Web App Firewall Integration:cisco_asa Cisco ASA Integration:cisco_ios Cisco IOS labels Dec 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dwhyrock dwhyrock dwhyrock approved these changes

Assignees

@taylor-swanson taylor-swanson

Labels
enhancement New feature or request Integration:arista_ngfw Arista NG Firewall Integration:cef Common Event Format (CEF) Integration:checkpoint Check Point Integration:cisco_aironet Cisco Aironet Integration:cisco_asa Cisco ASA Integration:cisco_ftd Cisco FTD Integration:cisco_ios Cisco IOS Integration:cisco_ise Cisco ISE Integration:cisco_nexus Cisco Nexus Integration:cisco_secure_email_gateway Cisco Secure Email Gateway Integration:citrix_waf Citrix Web App Firewall Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@taylor-swanson @elasticmachine @dwhyrock @andrewkroh