Skip to content

Update SEI packages to package-spec format 2.7.0 (Part 1) #6135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
taylor-swanson merged 5 commits into from
May 10, 2023
Merged

Update SEI packages to package-spec format 2.7.0 (Part 1) #6135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
41dc8cb
Update packages to format 2.7.0
taylor-swanson May 9, 2023
2c9fdd2
Update changelogs
taylor-swanson May 9, 2023
642f760
Revert ECS git ref
taylor-swanson May 9, 2023
55c6b1a
Regenerate sample events to fix tests
taylor-swanson May 9, 2023
4b2541e
Regen readme
taylor-swanson May 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/akamai/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.7.0"
Copy link
Contributor

@bhapas bhapas May 10, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@taylor-swanson #6115 (comment)

Not sure if the issues mentioned by @andrewkroh are tested before the beta is removed for akamai.

Copy link
Contributor Author

@taylor-swanson taylor-swanson May 10, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh shoot, didn't see that. The ecs-update tool didn't keep the -beta flag, and I must've just glossed over it. This is a mess, we really need to think of a better strategy for this sort of thing, as it practically blocks normal updates to packages.

changes:
- description: Update package-spec version to 2.7.0.
type: enhancement
link: https://github.com/elastic/integrations/pull/6135
- version: "2.6.2-beta"
changes:
- description: Added support for the 'to' query parameter in the initial time based requests.
Expand Down
8 changes: 6 additions & 2 deletions packages/akamai/data_stream/siem/_dev/test/pipeline/test-http-json.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,9 @@
"version": "8.7.0"
},
"event": {
"category": "network",
"category": [
"network"
],
"id": "1158db1758e37bfe67b7c09",
"kind": "event",
"original": "{\"format\":\"json\",\"type\":\"akamai_siem\",\"version\":\"1.0\",\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"14227\",\"policyId\":\"qik1_26545\",\"ruleActions\":\"YWxlcnQ%3d%3bYWxlcnQ%3d%3bZGVueQ%3d%3d\",\"ruleData\":\"dGVsbmV0LmV4ZQ%3d%3d%3bdGVsbmV0LmV4ZQ%3d%3d%3bVmVjdG9yIFNjb3JlOiAxMCwgREVOWSB0aHJlc2hvbGQ6IDksIEFsZX \",\"ruleMessages\":\"U3lzdGVtIENvbW1hbmQgQWNjZXNz%3bU3lzdGVtIENvbW1hbmQgSW5qZWN0aW9u%3bQW5vbWFseSBTY29yZSBFeGNlZWRlZCBmb3 \",\"ruleSelectors\":\"QVJHUzpvcHRpb24%3d%3bQVJHUzpvcHRpb24%3d%3b\",\"ruleTags\":\"T1dBU1BfQ1JTL1dFQl9BVFRBQ0svRklMRV9JTkpFQ1RJT04%3d%3bT1dBU1BfQ1JTL1dFQl9BVFRBQ0svQ09NTUFORF9JTkpFQ1R \",\"ruleVersions\":\"NA%3d%3d%3bNA%3d%3d%3bMQ%3d%3d\",\"rules\":\"OTUwMDAy%3bOTUwMDA2%3bQ01ELUlOSkVDVElPTi1BTk9NQUxZ\"},\"geo\":{\"asn\":\"14618\",\"city\":\"ASHBURN\",\"continent\":\"288\",\"country\":\"US\",\"regionCode\":\"VA\"},\"httpMessage\":{\"bytes\":\"266\",\"host\":\"www.hmapi.com\",\"method\":\"GET\",\"path\":\"/\",\"port\":\"80\",\"protocol\":\"HTTP/1.1\",\"query\":\"option=com_jce%20telnet.exe\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"1158db1758e37bfe67b7c09\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml%0d%0aContent-Length%3a%20150\",\"start\":\"1491303422\",\"status\":\"200\"},\"userRiskData\":{\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\",\"status\":\"0\",\"score\":\"75\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"trust\":\"ugp:US\",\"general\":\"duc_1h:10|duc_1d:30\",\"allow\":\"0\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"}}",
Expand Down Expand Up @@ -273,7 +275,9 @@
"version": "8.7.0"
},
"event": {
"category": "network",
"category": [
"network"
],
"id": "2ab418ac8515f33",
"kind": "event",
"original": "{\"format\":\"json\",\"type\":\"akamai_siem\",\"version\":\"1.0\",\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"6724\",\"policyId\":\"scoe_5426\",\"ruleActions\":\"QUxFUlQ;REVOWQ==\",\"ruleData\":\"YWxlcnQo;Y3VybA==\",\"ruleMessages\":\"Q3Jvc3Mtc2l0ZSBTY3 JpcHRpbmcgKFhTUykgQXR0YWNr; UmVxdWVzdCBJbmRpY2F0ZXMgYW4 gYXV0b21hdGVkIHByb2 dyYW0gZXhwbG9yZWQgdGhlIHNpdGU=\",\"ruleSelectors\":\"QVJHUzph;UkVRVUVTVF9IRU FERVJTOlVzZXItQWdlbnQ=\",\"ruleTags\":\"V0VCX0FUVEFDSy9YU1M=;QV VUT01BVElPTi9NSVND\",\"ruleVersions\":\";\",\"rules\":\"OTUwMDA0;OTkwMDEx\"},\"geo\":{\"asn\":\"12271\",\"city\":\"NEWYORK\",\"continent\":\"NA\",\"country\":\"US\",\"regionCode\":\"NY\"},\"httpMessage\":{\"bytes\":\"34523\",\"host\":\"www.example.com\",\"method\":\"POST\",\"path\":\"/examples/1/\",\"port\":\"80\",\"protocol\":\"http/2\",\"query\":\"a%3D..%2F..%2F..%2Fetc%2Fpasswd\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"2ab418ac8515f33\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml\",\"start\":\"1470923133.026\",\"status\":\"301\",\"tls\": \"TLSv1.2\"},\"userRiskData\":{\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\",\"status\":\"0\",\"score\":\"75\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"trust\":\"ugp:US\",\"general\":\"duc_1h:10|duc_1d:30\",\"allow\":\"0\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"}}",
Expand Down
2 changes: 1 addition & 1 deletion packages/akamai/data_stream/siem/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -411,7 +411,7 @@ processors:
copy_from: source
- set:
field: event.category
value: network
value: [network]
- set:
field: event.kind
value: event
Expand Down
1 change: 0 additions & 1 deletion packages/akamai/data_stream/siem/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
- name: akamai.siem
type: group
release: beta
default_field: false
description: >
Fields for Akamai SIEM Logs
Expand Down
20 changes: 11 additions & 9 deletions packages/akamai/data_stream/siem/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
{
"@timestamp": "2016-08-11T13:45:33.026Z",
"agent": {
"ephemeral_id": "e19b5d16-c564-495d-b698-c62518e5bd2d",
"id": "8f529f3f-731a-445a-be12-a74c00235b26",
"ephemeral_id": "9bba2ff8-f15b-4c09-8ac9-60ee0045a851",
"id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.3.2"
"version": "8.8.0"
},
"akamai": {
"siem": {
Expand Down Expand Up @@ -110,17 +110,19 @@
"version": "8.7.0"
},
"elastic_agent": {
"id": "8f529f3f-731a-445a-be12-a74c00235b26",
"snapshot": false,
"version": "8.3.2"
"id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a",
"snapshot": true,
"version": "8.8.0"
},
"event": {
"agent_id_status": "verified",
"category": "network",
"created": "2022-07-18T23:04:41.747Z",
"category": [
"network"
],
"created": "2023-05-09T21:06:11.267Z",
"dataset": "akamai.siem",
"id": "2ab418ac8515f33",
"ingested": "2022-07-18T23:04:42Z",
"ingested": "2023-05-09T21:06:12Z",
"kind": "event",
"original": "{\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"6724\",\"policyId\":\"scoe_5426\",\"ruleActions\":\"QUxFUlQ;REVOWQ==\",\"ruleData\":\"YWxlcnQo;Y3VybA==\",\"ruleMessages\":\"Q3Jvc3Mtc2l0ZSBTY3 JpcHRpbmcgKFhTUykgQXR0YWNr; UmVxdWVzdCBJbmRpY2F0ZXMgYW4 gYXV0b21hdGVkIHByb2 dyYW0gZXhwbG9yZWQgdGhlIHNpdGU=\",\"ruleSelectors\":\"QVJHUzph;UkVRVUVTVF9IRU FERVJTOlVzZXItQWdlbnQ=\",\"ruleTags\":\"V0VCX0FUVEFDSy9YU1M=;QV VUT01BVElPTi9NSVND\",\"ruleVersions\":\";\",\"rules\":\"OTUwMDA0;OTkwMDEx\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"format\":\"json\",\"geo\":{\"asn\":\"12271\",\"city\":\"NEWYORK\",\"continent\":\"NA\",\"country\":\"US\",\"regionCode\":\"NY\"},\"httpMessage\":{\"bytes\":\"34523\",\"host\":\"www.example.com\",\"method\":\"POST\",\"path\":\"/examples/1/\",\"port\":\"80\",\"protocol\":\"http/2\",\"query\":\"a%3D..%2F..%2F..%2Fetc%2Fpasswd\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"2ab418ac8515f33\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml\",\"start\":\"1470923133.026\",\"status\":\"301\",\"tls\":\"TLSv1.2\"},\"type\":\"akamai_siem\",\"userRiskData\":{\"allow\":\"0\",\"general\":\"duc_1h:10|duc_1d:30\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"score\":\"75\",\"status\":\"0\",\"trust\":\"ugp:US\",\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\"},\"version\":\"1.0\"}",
"start": "2016-08-11T13:45:33.026Z"
Expand Down
20 changes: 11 additions & 9 deletions packages/akamai/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,11 +151,11 @@ An example event for `siem` looks as following:
{
"@timestamp": "2016-08-11T13:45:33.026Z",
"agent": {
"ephemeral_id": "e19b5d16-c564-495d-b698-c62518e5bd2d",
"id": "8f529f3f-731a-445a-be12-a74c00235b26",
"ephemeral_id": "9bba2ff8-f15b-4c09-8ac9-60ee0045a851",
"id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.3.2"
"version": "8.8.0"
},
"akamai": {
"siem": {
Expand Down Expand Up @@ -260,17 +260,19 @@ An example event for `siem` looks as following:
"version": "8.7.0"
},
"elastic_agent": {
"id": "8f529f3f-731a-445a-be12-a74c00235b26",
"snapshot": false,
"version": "8.3.2"
"id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a",
"snapshot": true,
"version": "8.8.0"
},
"event": {
"agent_id_status": "verified",
"category": "network",
"created": "2022-07-18T23:04:41.747Z",
"category": [
"network"
],
"created": "2023-05-09T21:06:11.267Z",
"dataset": "akamai.siem",
"id": "2ab418ac8515f33",
"ingested": "2022-07-18T23:04:42Z",
"ingested": "2023-05-09T21:06:12Z",
"kind": "event",
"original": "{\"attackData\":{\"clientIP\":\"89.160.20.156\",\"configId\":\"6724\",\"policyId\":\"scoe_5426\",\"ruleActions\":\"QUxFUlQ;REVOWQ==\",\"ruleData\":\"YWxlcnQo;Y3VybA==\",\"ruleMessages\":\"Q3Jvc3Mtc2l0ZSBTY3 JpcHRpbmcgKFhTUykgQXR0YWNr; UmVxdWVzdCBJbmRpY2F0ZXMgYW4 gYXV0b21hdGVkIHByb2 dyYW0gZXhwbG9yZWQgdGhlIHNpdGU=\",\"ruleSelectors\":\"QVJHUzph;UkVRVUVTVF9IRU FERVJTOlVzZXItQWdlbnQ=\",\"ruleTags\":\"V0VCX0FUVEFDSy9YU1M=;QV VUT01BVElPTi9NSVND\",\"ruleVersions\":\";\",\"rules\":\"OTUwMDA0;OTkwMDEx\"},\"botData\":{\"botScore\":\"100\",\"responseSegment\":\"3\"},\"clientData\":{\"appBundleId\":\"com.mydomain.myapp\",\"appVersion\":\"1.23\",\"sdkVersion\":\"4.7.1\",\"telemetryType\":\"2\"},\"format\":\"json\",\"geo\":{\"asn\":\"12271\",\"city\":\"NEWYORK\",\"continent\":\"NA\",\"country\":\"US\",\"regionCode\":\"NY\"},\"httpMessage\":{\"bytes\":\"34523\",\"host\":\"www.example.com\",\"method\":\"POST\",\"path\":\"/examples/1/\",\"port\":\"80\",\"protocol\":\"http/2\",\"query\":\"a%3D..%2F..%2F..%2Fetc%2Fpasswd\",\"requestHeaders\":\"User-Agent%3a%20BOT%2f0.1%20(BOT%20for%20JCE)%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml\",\"requestId\":\"2ab418ac8515f33\",\"responseHeaders\":\"Server%3a%20AkamaiGHost%0d%0aMime-Version%3a%201.0%0d%0aContent-Type%3a%20text%2fhtml\",\"start\":\"1470923133.026\",\"status\":\"301\",\"tls\":\"TLSv1.2\"},\"type\":\"akamai_siem\",\"userRiskData\":{\"allow\":\"0\",\"general\":\"duc_1h:10|duc_1d:30\",\"risk\":\"udfp:1325gdg4g4343g/M|unp:74256/H\",\"score\":\"75\",\"status\":\"0\",\"trust\":\"ugp:US\",\"uuid\":\"964d54b7-0821-413a-a4d6-8131770ec8d5\"},\"version\":\"1.0\"}",
"start": "2016-08-11T13:45:33.026Z"
Expand Down
6 changes: 2 additions & 4 deletions packages/akamai/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
name: akamai
title: Akamai
version: "2.6.2-beta"
release: ga
version: "2.7.0"
description: Collect logs from Akamai with Elastic Agent.
type: integration
format_version: 1.0.0
license: basic
format_version: 2.7.0
categories: [security, cdn_security]
conditions:
kibana.version: "^8.4.0"
Expand Down
5 changes: 5 additions & 0 deletions packages/atlassian_bitbucket/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.8.0"
changes:
- description: Update package-spec version to 2.7.0.
type: enhancement
link: https://github.com/elastic/integrations/pull/6135
- version: "1.7.0"
changes:
- description: Update package to ECS 8.7.0.
Expand Down
6 changes: 2 additions & 4 deletions packages/atlassian_bitbucket/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,12 @@
format_version: 1.0.0
format_version: 2.7.0
name: atlassian_bitbucket
title: Atlassian Bitbucket
version: "1.7.0"
license: basic
version: "1.8.0"
description: Collect logs from Atlassian Bitbucket with Elastic Agent.
type: integration
categories:
- security
- productivity_security
release: ga
conditions:
kibana.version: "^7.16.0 || ^8.0.0"
icons:
Expand Down
5 changes: 5 additions & 0 deletions packages/atlassian_confluence/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.9.0"
changes:
- description: Update package-spec version to 2.7.0.
type: enhancement
link: https://github.com/elastic/integrations/pull/6135
- version: "1.8.0"
changes:
- description: Update package to ECS 8.7.0.
Expand Down
Loading