Sdh4854 panw username parsing expansion - #10456
Conversation
- Panorama App allows more username flexibility than the grok patterns supported. - Add a catch-all pattern as a fall-through. - Add sample data and ensure tests pass.
…anw_username_parsing
…anw_username_parsing
🚀 Benchmarks reportTo see the full report comment with |
| - '^%{PATRUNKATEDHOSTNAME:source.user.domain}\\%{USERNAME:source.user.name}$' | ||
| - '^%{PATRUNKATEDHOSTNAME:source.user.domain}\\\\%{USERNAME:source.user.name}$' | ||
| - '^%{USERNAME:source.user.name}@%{PATRUNKATEDHOSTNAME:source.user.domain}$' | ||
| - '^%{USERNAME:source.user.name}$' |
There was a problem hiding this comment.
| - '^%{USERNAME:source.user.name}$' |
I guess there's no advantage to keeping the USERNAME pattern, since the content will be captured by the GREEDYDATA pattern anyways if it fails.
There was a problem hiding this comment.
That's a great catch. I'll remove it.
taylor-swanson
added
Integration:panw
|
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
| - '^%{USERNAME:destination.user.name}@%{PATRUNKATEDHOSTNAME:destination.user.domain}$' | ||
| - '^%{USERNAME:destination.user.name}$' | ||
| - '^%{GREEDYDATA:destination.user.name}$' | ||
| pattern_definitions: |
There was a problem hiding this comment.
Add a tag to this processor, too.
| - '^%{PATRUNKATEDHOSTNAME:destination.user.domain}\\%{USERNAME:destination.user.name}$' | ||
| - '^%{PATRUNKATEDHOSTNAME:destination.user.domain}\\\\%{USERNAME:destination.user.name}$' | ||
| - '^%{USERNAME:destination.user.name}@%{PATRUNKATEDHOSTNAME:destination.user.domain}$' |
There was a problem hiding this comment.
I'm still not thrilled about these patterns using the complicated pattern definitions, but I suppose we found a solution that doesn't need to involve touching these other patterns.
💚 Build Succeeded
History
|
|
|
Package panw - 3.26.3 containing this change is available at https://epr.elastic.co/search?package=panw |
4 participants
Label: Bug
Proposed commit message
[panw] Add a catch-all pattern for srcuser/dstuser for the Panorama app
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues