[panw] Fix x-fwd-for parsing

[dwhyrock]

Proposed commit message

Moving src/dst user processing to down around the labels processors, and added a rename processor in between. This allows the x-fwd-for processing to now function correctly.

Thanks to @taylor-swanson for figuring out the issue and creating the initial change.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• Should the x_forwarded_for value have x-fwd-for string in it? (e.g., "x_forwarded_for": "x-fwd-for: 10.34.32.4")
  • Answer: no. Added fix to remove that string.

How to test this PR locally

Related issues

• Relates https://github.com/elastic/sdh-beats/issues/4933

Screenshots

Snippets before the change:

+            "panw": {
+                "panos": {
<snip>
+                    "url_idx": "1",
+                    "virtual_sys": "vsys1",
+                    "wildfire": {
+                        "report_id": "0"
+                    }
+                }
+            },
<snip> # notice no x-fwd-for above
+            "source": {
+                "geo": {
+                    "name": "10.0.0.0-10.255.255.255"
+                },
+                "ip": "10.64.217.27",
+                "port": 61736,
+                "user": {
+                    "name": "x-fwd-for: 10.34.32.4"
+                }
+            },

Snippets after the change

+            "panw": {
+                "panos": {
<snip>
+                    "url_idx": "1",
+                    "virtual_sys": "vsys1",
+                    "wildfire": {
+                        "report_id": "0"
+                    },
+                    "x_forwarded_for": "x-fwd-for: 10.34.32.4"
+                }
+            },
<snip>
+            "source": {
+                "geo": {
+                    "name": "10.0.0.0-10.255.255.255"
+                },
+                "ip": "10.64.217.27",
+                "port": 61736
+            },

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[pkoutsovasilis]

changelog and manifest updates?

[pkoutsovasilis]

LGTM

[elastic-sonarqube]

Quality Gate failed

Failed conditions
76.6% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 29505df

History

• 💚 Build #14796 succeeded f5304ac
• 💔 Build #14755 failed c575b74

cc @dwhyrock

[elasticmachine]

Package panw - 4.0.1 containing this change is available at https://epr.elastic.co/search?package=panw