Skip to content

Commit 8b4f86f

Browse files
efd6efd6
committed
zscaler_zia: add strict field template mode for tcp and http_endpoint input data streams
This checks that the template version matches the current expected template version if the template specifies it, falling back to an assessment of the fields that are present in the message. The check is only performed when enabled, which is not the case by default.
1 parent 283ae72 commit 8b4f86f

File tree

55 files changed

+7769
-114
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+7769
-114
lines changed

‎packages/zscaler_zia/_dev/build/docs/README.md‎

Lines changed: 13 additions & 13 deletions
Large diffs are not rendered by default.

‎packages/zscaler_zia/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.11.0"
3+
changes:
4+
- description: Add strict field template mode for TCP and HTTP Endpoint input data streams.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13904
27
- version: "3.10.1"
38
changes:
49
- description: Fix default request trace enabled behavior.

‎packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,4 +125,4 @@
125125
}
126126
}
127127
]
128-
}
128+
}

‎packages/zscaler_zia/data_stream/audit/_dev/test/pipeline/test-audit-http-endpoint.log‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
{ "sourcetype": "zscalernss-audit","input": {"type": "http_endpoint"}, "event": { "time": "Mon Oct 16 22:55:48 2023", "recordid": "1234", "action": "Activate", "category": "DATA_LOSS_PREVENTION_RESOURCE", "subcategory": "DLP_DICTIONARY", "resource": "SSL Rule Name", "interface": "API", "adminid": "[email protected]", "clientip": "89.160.20.112", "result": "SUCCESS", "errorcode": "AUTHENTICATION_FAILED", "auditlogtype": "ZIA Portal Audit Log", "preaction": {}, "postaction": {} } }
1+
{"sourcetype":"zscalernss-audit","input":{"type":"http_endpoint"},"event":{"time":"Mon Oct 16 22:55:48 2023","recordid":"1234","action":"Activate","category":"DATA_LOSS_PREVENTION_RESOURCE","subcategory":"DLP_DICTIONARY","resource":"SSL Rule Name","interface":"API","adminid":"[email protected]","clientip":"89.160.20.112","result":"SUCCESS","errorcode":"AUTHENTICATION_FAILED","auditlogtype":"ZIA Portal Audit Log","preaction":{},"postaction":{},"timezone":"UTC"}}
2+
{"version":"v1","sourcetype":"zscalernss-audit","input":{"type":"http_endpoint"},"event":{"time":"Mon Oct 16 22:55:48 2023","recordid":"1234","action":"Activate","category":"DATA_LOSS_PREVENTION_RESOURCE","subcategory":"DLP_DICTIONARY","resource":"SSL Rule Name","interface":"API","adminid":"[email protected]","clientip":"89.160.20.112","result":"SUCCESS","errorcode":"AUTHENTICATION_FAILED","auditlogtype":"ZIA Portal Audit Log","preaction":{},"postaction":{},"timezone":"UTC"}}

‎packages/zscaler_zia/data_stream/audit/_dev/test/pipeline/test-audit-http-endpoint.log-expected.json‎

Lines changed: 84 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
],
1616
"id": "1234",
1717
"kind": "event",
18-
"original": "{ \"sourcetype\": \"zscalernss-audit\",\"input\": {\"type\": \"http_endpoint\"}, \"event\": { \"time\": \"Mon Oct 16 22:55:48 2023\", \"recordid\": \"1234\", \"action\": \"Activate\", \"category\": \"DATA_LOSS_PREVENTION_RESOURCE\", \"subcategory\": \"DLP_DICTIONARY\", \"resource\": \"SSL Rule Name\", \"interface\": \"API\", \"adminid\": \"[email protected]\", \"clientip\": \"89.160.20.112\", \"result\": \"SUCCESS\", \"errorcode\": \"AUTHENTICATION_FAILED\", \"auditlogtype\": \"ZIA Portal Audit Log\", \"preaction\": {}, \"postaction\": {} } }",
18+
"original": "{\"sourcetype\":\"zscalernss-audit\",\"input\":{\"type\":\"http_endpoint\"},\"event\":{\"time\":\"Mon Oct 16 22:55:48 2023\",\"recordid\":\"1234\",\"action\":\"Activate\",\"category\":\"DATA_LOSS_PREVENTION_RESOURCE\",\"subcategory\":\"DLP_DICTIONARY\",\"resource\":\"SSL Rule Name\",\"interface\":\"API\",\"adminid\":\"[email protected]\",\"clientip\":\"89.160.20.112\",\"result\":\"SUCCESS\",\"errorcode\":\"AUTHENTICATION_FAILED\",\"auditlogtype\":\"ZIA Portal Audit Log\",\"preaction\":{},\"postaction\":{},\"timezone\":\"UTC\"}}",
1919
"outcome": "success",
2020
"timezone": "UTC",
2121
"type": [
@@ -75,9 +75,90 @@
7575
"resource": "SSL Rule Name",
7676
"result": "SUCCESS",
7777
"sub_category": "DLP_DICTIONARY",
78-
"time": "2023-10-16T22:55:48.000Z"
78+
"time": "2023-10-16T22:55:48.000Z",
79+
"timezone": "UTC"
80+
}
81+
}
82+
},
83+
{
84+
"@timestamp": "2023-10-16T22:55:48.000Z",
85+
"ecs": {
86+
"version": "8.11.0"
87+
},
88+
"error": {
89+
"code": "AUTHENTICATION_FAILED"
90+
},
91+
"event": {
92+
"action": "activate",
93+
"category": [
94+
"configuration"
95+
],
96+
"id": "1234",
97+
"kind": "event",
98+
"original": "{\"version\":\"v1\",\"sourcetype\":\"zscalernss-audit\",\"input\":{\"type\":\"http_endpoint\"},\"event\":{\"time\":\"Mon Oct 16 22:55:48 2023\",\"recordid\":\"1234\",\"action\":\"Activate\",\"category\":\"DATA_LOSS_PREVENTION_RESOURCE\",\"subcategory\":\"DLP_DICTIONARY\",\"resource\":\"SSL Rule Name\",\"interface\":\"API\",\"adminid\":\"[email protected]\",\"clientip\":\"89.160.20.112\",\"result\":\"SUCCESS\",\"errorcode\":\"AUTHENTICATION_FAILED\",\"auditlogtype\":\"ZIA Portal Audit Log\",\"preaction\":{},\"postaction\":{},\"timezone\":\"UTC\"}}",
99+
"outcome": "success",
100+
"timezone": "UTC",
101+
"type": [
102+
"change"
103+
]
104+
},
105+
"related": {
106+
"ip": [
107+
"89.160.20.112"
108+
],
109+
"user": [
110+
"example",
111+
"[email protected]"
112+
]
113+
},
114+
"rule": {
115+
"category": "DLP_DICTIONARY",
116+
"name": "SSL Rule Name",
117+
"ruleset": "DATA_LOSS_PREVENTION_RESOURCE"
118+
},
119+
"source": {
120+
"geo": {
121+
"city_name": "Linköping",
122+
"continent_name": "Europe",
123+
"country_iso_code": "SE",
124+
"country_name": "Sweden",
125+
"location": {
126+
"lat": 58.4167,
127+
"lon": 15.6167
128+
},
129+
"region_iso_code": "SE-E",
130+
"region_name": "Östergötland County"
131+
},
132+
"ip": "89.160.20.112"
133+
},
134+
"tags": [
135+
"preserve_original_event",
136+
"preserve_duplicate_custom_fields"
137+
],
138+
"user": {
139+
"domain": "zscaler.com",
140+
"email": "[email protected]",
141+
"name": "example"
142+
},
143+
"zscaler_zia": {
144+
"audit": {
145+
"action": "Activate",
146+
"admin_id": "[email protected]",
147+
"audit_log_type": "ZIA Portal Audit Log",
148+
"category": "DATA_LOSS_PREVENTION_RESOURCE",
149+
"client_ip": "89.160.20.112",
150+
"error_code": "AUTHENTICATION_FAILED",
151+
"interface": "API",
152+
"record": {
153+
"id": "1234"
154+
},
155+
"resource": "SSL Rule Name",
156+
"result": "SUCCESS",
157+
"sub_category": "DLP_DICTIONARY",
158+
"time": "2023-10-16T22:55:48.000Z",
159+
"timezone": "UTC"
79160
}
80161
}
81162
}
82163
]
83-
}
164+
}

‎packages/zscaler_zia/data_stream/audit/_dev/test/pipeline/test-audit.log‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1-
{ "sourcetype": "zscalernss-audit", "event": { "time": "Mon Oct 16 22:55:48 2023", "recordid": "1234", "action": "Activate", "category": "DATA_LOSS_PREVENTION_RESOURCE", "subcategory": "DLP_DICTIONARY", "resource": "SSL Rule Name", "interface": "API", "adminid": "[email protected]", "clientip": "89.160.20.112", "result": "SUCCESS", "errorcode": "AUTHENTICATION_FAILED", "auditlogtype": "ZIA Portal Audit Log", "preaction": {}, "postaction": {} } }
1+
{ "sourcetype": "zscalernss-audit", "event": { "time": "Mon Oct 16 22:55:48 2023", "recordid": "1234", "action": "Activate", "category": "DATA_LOSS_PREVENTION_RESOURCE", "subcategory": "DLP_DICTIONARY", "resource": "SSL Rule Name", "interface": "API", "adminid": "[email protected]", "clientip": "89.160.20.112", "result": "SUCCESS", "errorcode": "AUTHENTICATION_FAILED", "auditlogtype": "ZIA Portal Audit Log", "preaction": {}, "postaction": {} , "timezone": "UTC"} }
22
{ "sourcetype": "zscalernss-audit", "event": { "time": "Mon Oct 16 22:55:48 2023", "recordid": "1234", "action": "Activate", "category": "DATA_LOSS_PREVENTION_RESOURCE", "subcategory": "DLP_DICTIONARY", "resource": "SSL Rule Name", "interface": "API", "adminid": "[email protected]", "clientip": "89.160.20.112", "result": "SUCCESS", "errorcode": "AUTHENTICATION_FAILED", "auditlogtype": "ZIA Portal Audit Log", "timezone": "UTC", "preaction": {}, "postaction": {} } }
3-
{"sourcetype":"zscalernss-audit","event":{"time":"Thu Jan 9 20:38:29 2025","recordid":"737420","action":"SIGN_OUT","category":"LOGIN","subcategory":"LOGIN","resource":"None","interface":"Unknown","adminid":"[email protected]","clientip":"Unknown","result":"SUCCESS","errorcode":"None","auditlogtype":"EC","preaction":{},"postaction":{}}}
3+
{"sourcetype":"zscalernss-audit","event":{"time":"Thu Jan 9 20:38:29 2025","recordid":"737420","action":"SIGN_OUT","category":"LOGIN","subcategory":"LOGIN","resource":"None","interface":"Unknown","adminid":"[email protected]","clientip":"Unknown","result":"SUCCESS","errorcode":"None","auditlogtype":"EC","preaction":{},"postaction":{},"timezone":"UTC"}}
4+
{"version":"v1", "sourcetype": "zscalernss-audit", "event": { "time": "Mon Oct 16 22:55:48 2023", "recordid": "1234", "action": "Activate", "category": "DATA_LOSS_PREVENTION_RESOURCE", "subcategory": "DLP_DICTIONARY", "resource": "SSL Rule Name", "interface": "API", "adminid": "[email protected]", "clientip": "89.160.20.112", "result": "SUCCESS", "errorcode": "AUTHENTICATION_FAILED", "auditlogtype": "ZIA Portal Audit Log", "preaction": {}, "postaction": {} , "timezone": "UTC"} }
5+
{"version":"v1", "sourcetype": "zscalernss-audit", "event": { "time": "Mon Oct 16 22:55:48 2023", "recordid": "1234", "action": "Activate", "category": "DATA_LOSS_PREVENTION_RESOURCE", "subcategory": "DLP_DICTIONARY", "resource": "SSL Rule Name", "interface": "API", "adminid": "[email protected]", "clientip": "89.160.20.112", "result": "SUCCESS", "errorcode": "AUTHENTICATION_FAILED", "auditlogtype": "ZIA Portal Audit Log", "timezone": "UTC", "preaction": {}, "postaction": {} } }
6+
{"version":"v1","sourcetype":"zscalernss-audit","event":{"time":"Thu Jan 9 20:38:29 2025","recordid":"737420","action":"SIGN_OUT","category":"LOGIN","subcategory":"LOGIN","resource":"None","interface":"Unknown","adminid":"[email protected]","clientip":"Unknown","result":"SUCCESS","errorcode":"None","auditlogtype":"EC","preaction":{},"postaction":{},"timezone":"UTC"}}

0 commit comments

Comments
 (0)