Skip to content

[fortinet_fortiproxy] Remap devname to observer.name and process url field #10679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
taylor-swanson merged 3 commits into from
Aug 7, 2024
Merged

[fortinet_fortiproxy] Remap devname to observer.name and process url field #10679

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3813030
[fortinet_fortiproxy] Remap devname to observer.name and process url …
taylor-swanson Aug 1, 2024
c91ed80
changelog
taylor-swanson Aug 1, 2024
7dc45f2
Add keep_original to uri_parts and remove redundant set processor
taylor-swanson Aug 2, 2024
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/fortinet_fortiproxy/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "0.3.0"
changes:
- description: Remap devname to observer.name and process url field.
type: enhancement
link: https://github.com/elastic/integrations/pull/10679
- version: "0.2.0"
changes:
- description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. Expanded categories.
Expand Down
84 changes: 56 additions & 28 deletions ...ges/fortinet_fortiproxy/data_stream/log/_dev/test/pipeline/test-example.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,12 +361,12 @@
"name": "external"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "internal"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -493,12 +493,12 @@
"name": "port1"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "port2"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -616,12 +616,12 @@
"name": "port1"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "port2"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -737,12 +737,12 @@
"name": "port1"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "port2"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -776,6 +776,12 @@
"packets": 0,
"port": 40946
},
"url": {
"domain": "google.com",
"original": "https://google.com/",
"path": "/",
"scheme": "https"
},
"user_agent": {
"device": {
"name": "Other"
Expand Down Expand Up @@ -869,12 +875,12 @@
"name": "port1"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "port2"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -908,6 +914,12 @@
"packets": 0,
"port": 57748
},
"url": {
"domain": "steampowered.com",
"original": "https://steampowered.com/",
"path": "/",
"scheme": "https"
},
"user_agent": {
"device": {
"name": "Other"
Expand Down Expand Up @@ -997,12 +1009,12 @@
"name": "port1"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "port2"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1036,6 +1048,12 @@
"packets": 0,
"port": 36834
},
"url": {
"domain": "github.com",
"original": "https://github.com/",
"path": "/",
"scheme": "https"
},
"user_agent": {
"device": {
"name": "Other"
Expand Down Expand Up @@ -1137,7 +1155,7 @@
"bytes": 290
},
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1177,6 +1195,8 @@
},
"url": {
"domain": "google.com",
"original": "https://google.com/",
"path": "/",
"scheme": "https"
},
"user_agent": {
Expand Down Expand Up @@ -1270,7 +1290,7 @@
"bytes": 82
},
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1301,6 +1321,8 @@
},
"url": {
"domain": "google.com",
"original": "https://google.com/",
"path": "/",
"scheme": "https"
},
"user_agent": {
Expand Down Expand Up @@ -1394,7 +1416,7 @@
"bytes": 743
},
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1425,6 +1447,8 @@
},
"url": {
"domain": "google.com",
"original": "https://google.com/",
"path": "/",
"scheme": "https"
},
"user_agent": {
Expand Down Expand Up @@ -1518,7 +1542,7 @@
"bytes": 80
},
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1549,6 +1573,8 @@
},
"url": {
"domain": "adobe.com",
"original": "https://adobe.com/",
"path": "/",
"scheme": "https"
},
"user_agent": {
Expand Down Expand Up @@ -1642,7 +1668,7 @@
"bytes": 88
},
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1673,6 +1699,8 @@
},
"url": {
"domain": "www.adobe.com",
"original": "https://www.adobe.com/",
"path": "/",
"scheme": "https"
},
"user_agent": {
Expand Down Expand Up @@ -1736,7 +1764,7 @@
},
"message": "Performance statistics: average CPU: 0, memory: 29, concurrent sessions: 119, setup-rate: 0",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1783,7 +1811,7 @@
},
"message": "failed to send urlfilter packet",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1829,7 +1857,7 @@
},
"message": "interface port1 gets a DHCP lease, ip:10.0.128.2, mask:255.255.255.255, gateway:10.0.128.1, lease expires:Tue May 7 10:11:16 2024",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1900,7 +1928,7 @@
},
"message": "Administrator Admin login failed from https(175.16.199.42) because of invalid user name",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -1965,7 +1993,7 @@
},
"message": "Fortiproxyupdate now fsci=yes from 175.16.199:443",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2019,7 +2047,7 @@
},
"message": "Edit firewall.policy 1",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2072,7 +2100,7 @@
},
"message": "Delete firewall.policy 3",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2126,7 +2154,7 @@
},
"message": "Add firewall.policy 2",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2179,7 +2207,7 @@
},
"message": "Move firewall.policy 2 to 1",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2233,7 +2261,7 @@
}
},
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2287,7 +2315,7 @@
}
},
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2341,7 +2369,7 @@
}
},
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2388,7 +2416,7 @@
},
"message": "Attempt to add tag FCTEMS_ALL_FORTICLOUD_SERVERS failed. Code (-2147483646)",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2459,12 +2487,12 @@
"name": "port1"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "port2"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2569,12 +2597,12 @@
"name": "port1"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "port2"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2658,7 +2686,7 @@
},
"message": "Performance statistics: average CPU: 0, memory: 29, concurrent sessions: 38, setup-rate: 1",
"observer": {
"hostname": "TEST-PXY01",
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down Expand Up @@ -2749,12 +2777,12 @@
"name": "port1"
}
},
"hostname": "TEST-PXY01",
"ingress": {
"interface": {
"name": "port2"
}
},
"name": "TEST-PXY01",
"product": "FortiProxy",
"serial_number": "FPXTESTPXY01",
"type": "proxy",
Expand Down
Loading