Skip to content

barracuda.waf: Improve access logs parsing - #11339

Merged
kcreddy merged 5 commits into
elastic:mainfrom
kcreddy:barr-waf-parsing
Oct 8, 2024
Merged

barracuda.waf: Improve access logs parsing#11339
kcreddy merged 5 commits into
elastic:mainfrom
kcreddy:barr-waf-parsing

Conversation

@kcreddy

@kcreddy kcreddy commented Oct 5, 2024

Copy link
Copy Markdown
Contributor

Proposed commit message

See title

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

By running package's pipeline tests:
$ cd packages/barracuda && elastic-package build && elastic-package stack up --version=8.13.0 -d -v && eval "$(elastic-package stack shellinit)" && elastic-package test pipeline --generate -v
Results:

--- Test results for package: barracuda - START ---
╭───────────┬─────────────┬───────────┬──────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE   │ DATA STREAM │ TEST TYPE │ TEST NAME                                            │ RESULT │ TIME ELAPSED │
├───────────┼─────────────┼───────────┼──────────────────────────────────────────────────────┼────────┼──────────────┤
│ barracuda │ waf         │ pipeline  │ (ingest pipeline warnings test-access.log)           │ PASS   │    562.554ms │
│ barracuda │ waf         │ pipeline  │ (ingest pipeline warnings test-audit.log)            │ PASS   │ 522.431959ms │
│ barracuda │ waf         │ pipeline  │ (ingest pipeline warnings test-network-firewall.log) │ PASS   │ 541.532583ms │
│ barracuda │ waf         │ pipeline  │ (ingest pipeline warnings test-system.log)           │ PASS   │ 570.000959ms │
│ barracuda │ waf         │ pipeline  │ (ingest pipeline warnings test-web-firewall.log)     │ PASS   │ 462.074833ms │
│ barracuda │ waf         │ pipeline  │ test-access.log                                      │ PASS   │ 709.170458ms │
│ barracuda │ waf         │ pipeline  │ test-audit.log                                       │ PASS   │     47.437ms │
│ barracuda │ waf         │ pipeline  │ test-network-firewall.log                            │ PASS   │ 102.175042ms │
│ barracuda │ waf         │ pipeline  │ test-system.log                                      │ PASS   │   58.67625ms │
│ barracuda │ waf         │ pipeline  │ test-web-firewall.log                                │ PASS   │ 163.863958ms │
╰───────────┴─────────────┴───────────┴──────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: barracuda - END   ---
Done
@kcreddy kcreddy self-assigned this Oct 5, 2024
@kcreddy kcreddy added enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:barracuda Barracuda Web Application Firewall labels Oct 5, 2024
@kcreddy
kcreddy marked this pull request as ready for review October 7, 2024 07:18
@kcreddy
kcreddy requested a review from a team as a code owner October 7, 2024 07:18
@elasticmachine

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Oct 7, 2024

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

Comment thread packages/barracuda/changelog.yml Outdated
Comment thread packages/barracuda/data_stream/waf/elasticsearch/ingest_pipeline/default.yml Outdated
Comment thread packages/barracuda/data_stream/waf/elasticsearch/ingest_pipeline/access.yml Outdated
Comment thread packages/barracuda/data_stream/waf/elasticsearch/ingest_pipeline/access.yml Outdated
Comment thread packages/barracuda/data_stream/waf/elasticsearch/ingest_pipeline/access.yml Outdated
@kcreddy
kcreddy requested a review from efd6 October 8, 2024 07:48
@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @kcreddy

@kcreddy
kcreddy merged commit f5ab5ff into elastic:main Oct 8, 2024
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package barracuda - 1.16.0 containing this change is available at https://epr.elastic.co/search?package=barracuda

harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
* Improve Barracude WAF Access logs parsing.
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
* Improve Barracude WAF Access logs parsing.
@kcreddy
kcreddy deleted the barr-waf-parsing branch February 7, 2025 09:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:barracuda Barracuda Web Application Firewall Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants