Skip to content

imperva_cloud_waf: Handle multiple IPs in cef.extensions.xff - #13244

Merged
kcreddy merged 3 commits into
elastic:mainfrom
kcreddy:imperva_cloud-ips
Mar 25, 2025
Merged

imperva_cloud_waf: Handle multiple IPs in cef.extensions.xff#13244
kcreddy merged 3 commits into
elastic:mainfrom
kcreddy:imperva_cloud-ips

Conversation

@kcreddy

@kcreddy kcreddy commented Mar 21, 2025

Copy link
Copy Markdown
Contributor

Proposed commit message

It is possible that cef.extensions.xff can contain ',' separated 
IPs. Handle such cases and convert the field as array by default.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Passes pipeline tests (with comma-separated xff)

--- Test results for package: imperva_cloud_waf - START ---
╭───────────────────┬─────────────┬───────────┬────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE           │ DATA STREAM │ TEST TYPE │ TEST NAME                                  │ RESULT │ TIME ELAPSED │
├───────────────────┼─────────────┼───────────┼────────────────────────────────────────────┼────────┼──────────────┤
│ imperva_cloud_waf │ event       │ pipeline  │ (ingest pipeline warnings test-event.json) │ PASS   │ 376.180458ms │
│ imperva_cloud_waf │ event       │ pipeline  │ test-event.json                            │ PASS   │ 111.661208ms │
╰───────────────────┴─────────────┴───────────┴────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: imperva_cloud_waf - END   ---
Done
@kcreddy kcreddy self-assigned this Mar 21, 2025
@kcreddy kcreddy added bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:imperva_cloud_waf Imperva Cloud WAF labels Mar 21, 2025
kcreddy
kcreddy commented Mar 21, 2025
View reviewed changes
Comment thread packages/imperva_cloud_waf/data_stream/event/_dev/test/pipeline/test-event.json
"Customer": "CEFcustomer123",
"cs11": "[{\"api_specification_violation_type\":\"INVALID_PARAM_NAME\",\"parameter_name\":\"somename\"}]",
"deviceFacility": "mia",
"xff": "1.128.0.0, 81.2.69.144",

@kcreddy kcreddy Mar 21, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"xff": "1.128.0.0, 81.2.69.144" comma-separated values
@kcreddy
kcreddy marked this pull request as ready for review March 21, 2025 16:33
@kcreddy
kcreddy requested a review from a team as a code owner March 21, 2025 16:33
@elasticmachine

elasticmachine commented Mar 21, 2025

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
efd6
efd6 reviewed Mar 23, 2025
View reviewed changes
Comment thread packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml Outdated
Comment on lines +565 to +575
# - convert:
# field: cef.extensions.xff
# tag: convert_extensions_xff_to_ip
# target_field: imperva_cloud_waf.event.extensions.xff
# type: ip
# ignore_missing: true
# if: ctx.cef?.extensions?.xff != null && ctx.cef.extensions.xff != ''
# on_failure:
# - append:
# field: error.message
# value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'

@efd6 efd6 Mar 23, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove?

@kcreddy kcreddy Mar 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤦🏼‍♂️

@kcreddy kcreddy Mar 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in 56f63fc
@kcreddy
kcreddy requested a review from efd6 March 25, 2025 05:44
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Mar 25, 2025

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

Package imperva_cloud_waf 👍(0) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
event 1636.66 1283.7 -352.96 (-21.57%) 💔

To see the full report comment with /test benchmark fullreport
@elasticmachine

elasticmachine commented Mar 25, 2025

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @kcreddy
@elastic-sonarqube

elastic-sonarqube Bot commented Mar 25, 2025

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@kcreddy
kcreddy merged commit 286fe7b into elastic:main Mar 25, 2025
@kcreddy
kcreddy deleted the imperva_cloud-ips branch March 25, 2025 07:40
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Mar 25, 2025

Copy link
Copy Markdown
Contributor

Package imperva_cloud_waf - 1.11.2 containing this change is available at https://epr.elastic.co/package/imperva_cloud_waf/1.11.2/
flexitrev pushed a commit that referenced this pull request Mar 25, 2025
@kcreddy @flexitrev
imperva_cloud_waf: Handle multiple IPs in cef.extensions.xff (#13244)
3c14db8 
It is possible that cef.extensions.xff can contain ',' separated
IPs. Handle such cases and convert the field as array by default.
flexitrev pushed a commit that referenced this pull request Mar 28, 2025
@kcreddy @flexitrev
imperva_cloud_waf: Handle multiple IPs in cef.extensions.xff (#13244)
6424546 
It is possible that cef.extensions.xff can contain ',' separated 
IPs. Handle such cases and convert the field as array by default.
flexitrev pushed a commit that referenced this pull request Mar 28, 2025
@kcreddy @flexitrev
imperva_cloud_waf: Handle multiple IPs in cef.extensions.xff (#13244)
2f9444d 
It is possible that cef.extensions.xff can contain ',' separated
IPs. Handle such cases and convert the field as array by default.
flexitrev pushed a commit that referenced this pull request Mar 28, 2025
@kcreddy @flexitrev
imperva_cloud_waf: Handle multiple IPs in cef.extensions.xff (#13244)
5060324 
It is possible that cef.extensions.xff can contain ',' separated
IPs. Handle such cases and convert the field as array by default.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:imperva_cloud_waf Imperva Cloud WAF Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@kcreddy @elasticmachine @efd6