Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[cisco_meraki] Replace rsa2elk pipeline and add webhook input #2897

Merged
merged 69 commits into from
Apr 27, 2022
Merged

[cisco_meraki] Replace rsa2elk pipeline and add webhook input #2897

merged 69 commits into from
Apr 27, 2022

Commits on Mar 10, 2022

  1. Update data stream and pipeline for webhook based integration

    @r00tu53r
    r00tu53r committed Mar 10, 2022
    Configuration menu
    Copy the full SHA
    e721129 View commit details
    Browse the repository at this point in the history

  2. fix title desc

    @r00tu53r
    r00tu53r committed Mar 10, 2022
    Configuration menu
    Copy the full SHA
    080ce7b View commit details
    Browse the repository at this point in the history

Commits on Mar 18, 2022

  1. Add support for syslog and webhook

    @r00tu53r
    r00tu53r committed Mar 18, 2022
    Configuration menu
    Copy the full SHA
    9d18070 View commit details
    Browse the repository at this point in the history

Commits on Mar 21, 2022

  1. Add pipeline tests for syslog flow, ipflow logs; Add sample_events fo… 

    …r webhook system tests
    @r00tu53r
    r00tu53r committed Mar 21, 2022
    Configuration menu
    Copy the full SHA
    a2ec877 View commit details
    Browse the repository at this point in the history

  2. Fix ip_flow_end pipeline for tsi or tdi case

    @r00tu53r
    r00tu53r committed Mar 21, 2022
    Configuration menu
    Copy the full SHA
    8c0c54a View commit details
    Browse the repository at this point in the history

  3. Add support for airmarshal events

    @r00tu53r
    r00tu53r committed Mar 21, 2022
    Configuration menu
    Copy the full SHA
    b0fbf8b View commit details
    Browse the repository at this point in the history

Commits on Mar 22, 2022

  1. Add support for security_event ids_alerted

    @r00tu53r
    r00tu53r committed Mar 22, 2022
    Configuration menu
    Copy the full SHA
    059cc9d View commit details
    Browse the repository at this point in the history

  2. Add support for security_event security_filtering_file_scanned type

    @r00tu53r
    r00tu53r committed Mar 22, 2022
    Configuration menu
    Copy the full SHA
    5cc4249 View commit details
    Browse the repository at this point in the history

  3. Add support for security_event security_filtering_disposition_change

    @r00tu53r
    r00tu53r committed Mar 22, 2022
    Configuration menu
    Copy the full SHA
    f5ad6e6 View commit details
    Browse the repository at this point in the history

Commits on Mar 23, 2022

  1. Refactor 

    - refactor fields to use flattened
- refactor pipelines to use kv
- have field groups for certain categories where src and dst ips are
  available
    @r00tu53r
    r00tu53r committed Mar 23, 2022
    Configuration menu
    Copy the full SHA
    686d7f3 View commit details
    Browse the repository at this point in the history

Commits on Mar 24, 2022

  1. Add support for site-to-site vpn event type 

    Anonymise test data
    @r00tu53r
    r00tu53r committed Mar 24, 2022
    Configuration menu
    Copy the full SHA
    07bc059 View commit details
    Browse the repository at this point in the history

  2. Add support for vpn_connectivity_change and refactor field groups

    @r00tu53r
    r00tu53r committed Mar 24, 2022
    Configuration menu
    Copy the full SHA
    6cdee00 View commit details
    Browse the repository at this point in the history

  3. Add support for dhcp lease and no offers 

    Comment and rearrange events pipeline
    @r00tu53r
    r00tu53r committed Mar 24, 2022
    Configuration menu
    Copy the full SHA
    36b8a6d View commit details
    Browse the repository at this point in the history

Commits on Mar 25, 2022

  1. Add support for client_vpn_connect log messages

    @r00tu53r
    r00tu53r committed Mar 25, 2022
    Configuration menu
    Copy the full SHA
    c3f9a38 View commit details
    Browse the repository at this point in the history

Commits on Mar 26, 2022

  1. Add support for urls type

    @r00tu53r
    r00tu53r committed Mar 26, 2022
    Configuration menu
    Copy the full SHA
    30d5bfd View commit details
    Browse the repository at this point in the history

  2. Add pipeline for ids-alerts

    @r00tu53r
    r00tu53r committed Mar 26, 2022
    Configuration menu
    Copy the full SHA
    f90f099 View commit details
    Browse the repository at this point in the history

Commits on Mar 27, 2022

  1. Update ECS version; add sub types for MR events

    @r00tu53r
    r00tu53r committed Mar 27, 2022
    Configuration menu
    Copy the full SHA
    68d96c1 View commit details
    Browse the repository at this point in the history

  2. Add system tests

    @r00tu53r
    r00tu53r committed Mar 27, 2022
    Configuration menu
    Copy the full SHA
    094d2ba View commit details
    Browse the repository at this point in the history

Commits on Mar 28, 2022

  1. set meraki device type for flows log messages

    @r00tu53r
    r00tu53r committed Mar 28, 2022
    Configuration menu
    Copy the full SHA
    293fe35 View commit details
    Browse the repository at this point in the history

  2. Update README; Disable webhook events by default; only enable syslog … 

    …UDP by default
    @r00tu53r
    r00tu53r committed Mar 28, 2022
    Configuration menu
    Copy the full SHA
    f5184d1 View commit details
    Browse the repository at this point in the history

  3. script to create event.category, type and action

    @r00tu53r
    r00tu53r committed Mar 28, 2022
    Configuration menu
    Copy the full SHA
    db5cdb2 View commit details
    Browse the repository at this point in the history

  4. fix formatting

    @r00tu53r
    r00tu53r committed Mar 28, 2022
    Configuration menu
    Copy the full SHA
    3d0910a View commit details
    Browse the repository at this point in the history

  5. regenerate README

    @r00tu53r
    r00tu53r committed Mar 28, 2022
    Configuration menu
    Copy the full SHA
    67c2517 View commit details
    Browse the repository at this point in the history

Commits on Mar 29, 2022

  1. Update README

    @r00tu53r
    r00tu53r committed Mar 29, 2022
    Configuration menu
    Copy the full SHA
    8556769 View commit details
    Browse the repository at this point in the history

  2. Update changelog

    @r00tu53r
    r00tu53r committed Mar 29, 2022
    Configuration menu
    Copy the full SHA
    9ef3fbe View commit details
    Browse the repository at this point in the history

  3. rename: test-events file

    @r00tu53r
    r00tu53r committed Mar 29, 2022
    Configuration menu
    Copy the full SHA
    35c5d15 View commit details
    Browse the repository at this point in the history

  4. Add dashboards and anonymize data

    @r00tu53r
    r00tu53r committed Mar 29, 2022
    Configuration menu
    Copy the full SHA
    e587ef0 View commit details
    Browse the repository at this point in the history

  5. Add dashboard screenshots

    @r00tu53r
    r00tu53r committed Mar 29, 2022
    Configuration menu
    Copy the full SHA
    dd29325 View commit details
    Browse the repository at this point in the history

Commits on Apr 1, 2022

  1. remove event.ingested

    @r00tu53r
    r00tu53r committed Apr 1, 2022
    Configuration menu
    Copy the full SHA
    eec69f0 View commit details
    Browse the repository at this point in the history

  2. use observer.mac to set wired_mac

    @r00tu53r
    r00tu53r committed Apr 1, 2022
    Configuration menu
    Copy the full SHA
    38cd8e6 View commit details
    Browse the repository at this point in the history

  3. use threat.indicator.* instead of threat.enrichments.indicator.*

    @r00tu53r
    r00tu53r committed Apr 1, 2022
    Configuration menu
    Copy the full SHA
    ec1c7c9 View commit details
    Browse the repository at this point in the history

  4. refactor

    @r00tu53r
    r00tu53r committed Apr 1, 2022
    Configuration menu
    Copy the full SHA
    cde66fc View commit details
    Browse the repository at this point in the history

  5. convert timestamp to date format in threat.indicator.last_seen

    @r00tu53r
    r00tu53r committed Apr 1, 2022
    Configuration menu
    Copy the full SHA
    ef185c0 View commit details
    Browse the repository at this point in the history

  6. add missing processors to logfile input

    @r00tu53r
    r00tu53r committed Apr 1, 2022
    Configuration menu
    Copy the full SHA
    9ea18ea View commit details
    Browse the repository at this point in the history

Commits on Apr 4, 2022

  1. change dissect to grok for airmarshal events

    @r00tu53r
    r00tu53r committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    7f7685f View commit details
    Browse the repository at this point in the history

  2. convert last_seen to date

    @r00tu53r
    r00tu53r committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    5748b24 View commit details
    Browse the repository at this point in the history

  3. add cloud and container field decls

    @r00tu53r
    r00tu53r committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    811ed78 View commit details
    Browse the repository at this point in the history

  4. resolve conflicts

    @r00tu53r
    r00tu53r committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    63cb292 View commit details
    Browse the repository at this point in the history

Commits on Apr 5, 2022

  1. events: pipeline for top-level fields and event handling

    @r00tu53r
    r00tu53r committed Apr 5, 2022
    Configuration menu
    Copy the full SHA
    de6aad3 View commit details
    Browse the repository at this point in the history

  2. support for alert types

    @r00tu53r
    r00tu53r committed Apr 5, 2022
    Configuration menu
    Copy the full SHA
    1e1f157 View commit details
    Browse the repository at this point in the history

  3. update readme

    @r00tu53r
    r00tu53r committed Apr 5, 2022
    Configuration menu
    Copy the full SHA
    02026bc View commit details
    Browse the repository at this point in the history

Commits on Apr 6, 2022

  1. update readme heading

    @r00tu53r
    r00tu53r committed Apr 6, 2022
    Configuration menu
    Copy the full SHA
    d819401 View commit details
    Browse the repository at this point in the history

  2. events: support for all documented event types

    @r00tu53r
    r00tu53r committed Apr 6, 2022
    Configuration menu
    Copy the full SHA
    e0b1dd0 View commit details
    Browse the repository at this point in the history

Commits on Apr 19, 2022

  1. Fixes, add support for subtypes 

    - Fix - wrongly set fields under site-to-site-vpn.
- Add support for dfs_event, 8021x_auth, multiple_dhcp_servers_detected
- Place mulitple_dhcp_servers_detected into ECS fields.
    @r00tu53r
    r00tu53r committed Apr 19, 2022
    Configuration menu
    Copy the full SHA
    4f57cfe View commit details
    Browse the repository at this point in the history

  2. use templating to avoid copying code

    @r00tu53r
    r00tu53r committed Apr 19, 2022
    Configuration menu
    Copy the full SHA
    efb5411 View commit details
    Browse the repository at this point in the history

  3. normalize mac address

    @r00tu53r
    r00tu53r committed Apr 19, 2022
    Configuration menu
    Copy the full SHA
    63e4bc2 View commit details
    Browse the repository at this point in the history

  4. update readme

    @r00tu53r
    r00tu53r committed Apr 19, 2022
    Configuration menu
    Copy the full SHA
    827104f View commit details
    Browse the repository at this point in the history

Commits on Apr 21, 2022

  1. Update flow_allowed event.type to connection,start

    @r00tu53r
    r00tu53r committed Apr 21, 2022
    Configuration menu
    Copy the full SHA
    709ef5c View commit details
    Browse the repository at this point in the history

  2. Remove session from event.type for ip_session_initiated

    @r00tu53r
    r00tu53r committed Apr 21, 2022
    Configuration menu
    Copy the full SHA
    464427b View commit details
    Browse the repository at this point in the history

  3. Remove device type detection

    @r00tu53r
    r00tu53r committed Apr 21, 2022
    Configuration menu
    Copy the full SHA
    23b36f0 View commit details
    Browse the repository at this point in the history

Commits on Apr 23, 2022

  1. Update packages/cisco_meraki/_dev/build/docs/README.md 

    Co-authored-by: Andrew Kroh <[email protected]>
    @r00tu53r @andrewkroh
    r00tu53r and andrewkroh authored Apr 23, 2022
    Configuration menu
    Copy the full SHA
    4a4e612 View commit details
    Browse the repository at this point in the history

  2. remove duplicated log.file.path field

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    6218ec8 View commit details
    Browse the repository at this point in the history

  3. fix ecs field references

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    9f5d58a View commit details
    Browse the repository at this point in the history

  4. set tag for painless script

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    65f30e9 View commit details
    Browse the repository at this point in the history

  5. replace set and remove with rename

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    ed315c3 View commit details
    Browse the repository at this point in the history

  6. set cisco_meraki.event_type directly instead of setting it into temp

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    5a6b7c9 View commit details
    Browse the repository at this point in the history

  7. remove conversion from nanos to millis

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    f021c46 View commit details
    Browse the repository at this point in the history

  8. refactor painless script

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    57865f3 View commit details
    Browse the repository at this point in the history

  9. convert to ip and set to source/destination.ipinstead of rename

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    97af528 View commit details
    Browse the repository at this point in the history

  10. convert to ip type; not dissect directly to source.ip

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    6b94eec View commit details
    Browse the repository at this point in the history

  11. consolidate geoip to main pipeline; convert to ip type

    @r00tu53r
    r00tu53r committed Apr 23, 2022
    Configuration menu
    Copy the full SHA
    d1dd45c View commit details
    Browse the repository at this point in the history

Commits on Apr 24, 2022

  1. move fields one level up from airmarshal to cisco_meraki group

    @r00tu53r
    r00tu53r committed Apr 24, 2022
    Configuration menu
    Copy the full SHA
    4ef708a View commit details
    Browse the repository at this point in the history

  2. update readme

    @r00tu53r
    r00tu53r committed Apr 24, 2022
    Configuration menu
    Copy the full SHA
    5bc8efe View commit details
    Browse the repository at this point in the history

  3. move airmarshal.ssid to ecs field network.name

    @r00tu53r
    r00tu53r committed Apr 24, 2022
    Configuration menu
    Copy the full SHA
    2c2a036 View commit details
    Browse the repository at this point in the history

  4. consolidate more instances of geoip processing to default

    @r00tu53r
    r00tu53r committed Apr 24, 2022
    Configuration menu
    Copy the full SHA
    567ee08 View commit details
    Browse the repository at this point in the history

Commits on Apr 26, 2022

  1. Merge branch 'main' into feat/replace-cisco-meraki

    @r00tu53r
    r00tu53r committed Apr 26, 2022
    Configuration menu
    Copy the full SHA
    c97807d View commit details
    Browse the repository at this point in the history

  2. fix conflict; update to ecs 8.2

    @r00tu53r
    r00tu53r committed Apr 26, 2022
    Configuration menu
    Copy the full SHA
    9857c5b View commit details
    Browse the repository at this point in the history

  3. handle ipv4 and ipv6 data; add convert to all places

    @r00tu53r
    r00tu53r committed Apr 26, 2022
    Configuration menu
    Copy the full SHA
    ad2a76f View commit details
    Browse the repository at this point in the history

  4. remove IPV6NOCOMPRESS grok pattern for ip with no port values

    @r00tu53r
    r00tu53r committed Apr 26, 2022
    Configuration menu
    Copy the full SHA
    62aaa69 View commit details
    Browse the repository at this point in the history