Skip to content

[Azure] Update ECS field mappings for firewall_logs data stream#16395

Merged
moxarth-rathod merged 4 commits intoelastic:mainfrom
moxarth-rathod:azure-field-mapping
Dec 15, 2025
Merged

[Azure] Update ECS field mappings for firewall_logs data stream#16395
moxarth-rathod merged 4 commits intoelastic:mainfrom
moxarth-rathod:azure-field-mapping

Conversation

@moxarth-rathod
Copy link
Contributor

@moxarth-rathod moxarth-rathod commented Dec 8, 2025 •
edited
Loading

Proposed commit message

azure: update ECS field mappings for firewall_logs data stream that includes the following changes
- add `destination.ip` to `destination.address` and `source.ip` to `source.address`.
- add `TranslatedIp` and `TranslatedPort` to `destination.nat.ip` and `destination.nat.port`.
- update event type mappings for AZFWNetworkRule and AZFWApplicationRule categories in firewall_logs data stream.
- remove `destination.ip` and `destination.port` mapping of `TranslatedIp` and `TranslatedPort`.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

@moxarth-rathod moxarth-rathod self-assigned this Dec 8, 2025
@moxarth-rathod moxarth-rathod requested a review from a team as a code owner December 8, 2025 08:56
@moxarth-rathod moxarth-rathod added the enhancement New feature or request label Dec 8, 2025
@moxarth-rathod moxarth-rathod requested review from a team as code owners December 8, 2025 08:56
@moxarth-rathod moxarth-rathod added Integration:azure Azure Logs Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Dec 8, 2025
@elasticmachine
Copy link

elasticmachine commented Dec 8, 2025

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Dec 8, 2025 •
edited
Loading

🚀 Benchmarks report

Package azure 👍(5) 💚(1) 💔(6)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
provisioning 6802.72 3003 -3799.72 (-55.86%) 💔
application_gateway 3311.26 2785.52 -525.74 (-15.88%) 💔
auditlogs 3861 1960.78 -1900.22 (-49.22%) 💔
eventhub 1e+06 333333.33 -666666.67 (-66.67%) 💔
firewall_logs 2008.03 1386.96 -621.07 (-30.93%) 💔
identity_protection 4545.45 3496.5 -1048.95 (-23.08%) 💔

To see the full report comment with /test benchmark fullreport

ShourieG
ShourieG reviewed Dec 10, 2025
View reviewed changes
@moxarth-rathod @ShourieG
Update packages/azure/changelog.yml
089a255 
Co-authored-by: Shourie Ganguly <shourie.ganguly@elastic.co>
kcreddy
kcreddy reviewed Dec 10, 2025
View reviewed changes
packages/azure/data_stream/firewall_logs/elasticsearch/ingest_pipeline/default.yml
Comment on lines 85 to 100
- rename:
field: json.properties.TranslatedPort
target_field: destination.port
ignore_missing: true
ignore_failure: true
if: ctx?.azure?.firewall?.properties?.DestinationPort == null
- set:
field: destination.nat.port
tag: set_destination_nat_port_from_properties_translated_port
copy_from: json.properties.TranslatedPort
ignore_empty_value: true
Copy link
Contributor

@kcreddy kcreddy Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

kcreddy
kcreddy reviewed Dec 10, 2025
View reviewed changes
@elasticmachine
Copy link

elasticmachine commented Dec 12, 2025

💚 Build Succeeded

History

cc @moxarth-rathod

ShourieG
ShourieG approved these changes Dec 12, 2025
View reviewed changes
Copy link
Contributor

@ShourieG ShourieG left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM from my end but please wait for @kcreddy

kcreddy
kcreddy approved these changes Dec 12, 2025
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks @moxarth-rathod !

@moxarth-rathod moxarth-rathod merged commit 47a663f into elastic:main Dec 15, 2025
7 checks passed
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Dec 15, 2025

Package azure - 1.31.0 containing this change is available at https://epr.elastic.co/package/azure/1.31.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kcreddy kcreddy kcreddy approved these changes

@ShourieG ShourieG ShourieG approved these changes

Assignees

@moxarth-rathod moxarth-rathod

Labels

enhancement New feature or request Integration:azure Azure Logs Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Azure Logs]: Firewall events not capturing *.address

4 participants

@moxarth-rathod @elasticmachine @kcreddy @ShourieG