Skip to content

[cisco_duo] Parse the adaptive_trust_assessments and rbfs_triggered_attacks fields for authentication logs - #16490

Merged
brijesh-elastic merged 2 commits into
elastic:mainfrom
brijesh-elastic:cisco_duo-2.8.0
Dec 11, 2025
Merged

[cisco_duo] Parse the adaptive_trust_assessments and rbfs_triggered_attacks fields for authentication logs#16490
brijesh-elastic merged 2 commits into
elastic:mainfrom
brijesh-elastic:cisco_duo-2.8.0

Conversation

@brijesh-elastic

Copy link
Copy Markdown
Contributor

Proposed commit message

cisco_duo: Parse the adaptive_trust_assessments and rbfs_triggered_attacks fields for authentication logs

Add support for the few missing fields, as well as the `adaptive_trust_assessments` and `rbfs_triggered_attacks`
fields in the `auth` data stream. A sample test case has been collected from the Cisco Duo documentation.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/cisco_duo directory.
  • Run the following command to run tests.

elastic-package test

@brijesh-elastic brijesh-elastic self-assigned this Dec 10, 2025
@brijesh-elastic
brijesh-elastic requested a review from a team as a code owner December 10, 2025 07:24
@brijesh-elastic brijesh-elastic added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:cisco_duo Cisco Duo Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Dec 10, 2025
@elasticmachine

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

cc @brijesh-elastic

@chemamartinez chemamartinez left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@brijesh-elastic
brijesh-elastic merged commit 0ad3e29 into elastic:main Dec 11, 2025
7 checks passed
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package cisco_duo - 2.8.0 containing this change is available at https://epr.elastic.co/package/cisco_duo/2.8.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:cisco_duo Cisco Duo Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants