Import zoom module from Filebeat

dev/import-beats-resources/zoom/docs/README.md

@@ -0,0 +1,11 @@
+# Zoom Webhook Integration
+
+This integration creates an HTTP listener that accepts incoming webhooks from Zoom.
+
+To configure Zoom to send webhooks to this integration, please follow the [Zoom Documentation.](https://marketplace.zoom.us/docs/guides/build/webhook-only-app)
+
+## Compatibility
+
+This integration is compatible with the Zoom Platform API as of September 2020.
+
+{{fields "webhook"}}

packages/zoom/data_stream/webhook/agent/stream/http_endpoint.yml.hbs

@@ -0,0 +1,30 @@
+listen_address: {{listen_address}}
+listen_port: {{listen_port}}
+prefix: {{prefix}}
+basic_auth: {{basic_auth}}
+username: {{password}}
+{{#if content_type}}
+content_type: "{{content_type}}"
+{{/if}}
+# Only set the secret options if a secret.value is set
+{{#if secret_value}}
+secret.header: "{{secret_header}}"
+secret.value: "{{secret_value}}"
+{{/if}}
+ssl: {{ssl}}
+tags:
+{{#each tags as |tag i|}}
+ - {{tag}}
+{{/each}}
+{{#contains tags "forwarded"}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+processors:
+  - decode_json_fields:
+      fields: [message]
+      target: zoom
+  - add_locale: ~
+  - add_fields:
+      target: ''
+      fields:
+        ecs.version: 1.5.0

packages/zoom/data_stream/webhook/agent/stream/log.yml.hbs

@@ -0,0 +1,21 @@
+paths:
+{{#each paths as |path i|}}
+  - {{path}}
+{{/each}}
+exclude_files: [".gz$"]
+tags:
+{{#each tags as |tag i|}}
+ - {{tag}}
+{{/each}}
+{{#contains tags "forwarded"}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+processors:
+  - decode_json_fields:
+      fields: [message]
+      target: zoom
+  - add_locale: ~
+  - add_fields:
+      target: ''
+      fields:
+        ecs.version: 1.5.0

packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/account.yml

@@ -0,0 +1,47 @@
+---
+description: Pipeline for parsing Zoom account webhooks
+processors:
+- append:
+    field: event.category
+    value: iam
+- append:
+    field: event.type
+    value: user
+- append:
+    field: event.type
+    value: creation
+    if: ctx?.event?.action == 'account.created'
+- append:
+    field: event.type
+    value: change
+    if: "['account.updated', 'account.settings_updated', 'account.disassociated'].contains(ctx?.event?.action)"
+- rename:
+    field: zoom.account_id
+    target_field: zoom.master_account_id
+    ignore_missing: true
+- rename:
+    field: zoom.object.id
+    target_field: zoom.sub_account_id
+    ignore_missing: true
+- date:
+    field: zoom.time_stamp
+    target_field: '@timestamp'
+    formats:
+    - UNIX_MS
+    if: ctx?.zoom?.time_stamp != null
+    ignore_failure: true
+- rename:
+    field: zoom.object
+    target_field: zoom.account
+    ignore_missing: true
+- append:
+    field: related.user
+    value: "{{zoom.account.owner_id}}"
+    if: ctx?.zoom?.account?.owner_id != null
+- remove:
+    field: zoom.time_stamp
+    ignore_missing: true
+on_failure:
+- set:
+    field: error.message
+    value: '{{ _ingest.on_failure_message }}'

packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/chat_channel.yml

@@ -0,0 +1,59 @@
+---
+description: Pipeline for parsing Zoom chat_channel webhooks
+processors:
+- append:
+    field: event.type
+    value: user
+    if: "['chat_channel.member_invited', 'chat_channel.member_joined', 'chat_channel.member_left'].contains(ctx?.event?.action)"
+- append:
+    field: event.type
+    value: creation
+    if: ctx?.event?.action == 'chat_channel.created'
+- append:
+    field: event.type
+    value: deletion
+    if: ctx?.event?.action == 'chat_channel.deleted'
+- append:
+    field: event.type
+    value: change
+    if: ctx?.event?.action == 'chat_channel.updated'
+- rename:
+    field: zoom.object
+    target_field: zoom.chat_channel
+    ignore_missing: true
+- date:
+    field: zoom.chat_channel.timestamp
+    target_field: '@timestamp'
+    formats:
+    - UNIX_MS
+    if: ctx?.zoom?.chat_channel?.timestamp != null
+    ignore_failure: true
+- remove:
+    field: zoom.chat_channel.date_time
+    ignore_missing: true
+    if: ctx?.zoom?.chat_channel?.timestamp != null
+- date:
+    field: zoom.chat_channel.date_time
+    target_field: '@timestamp'
+    formats:
+    - ISO_INSTANT
+    if: "ctx?.zoom?.chat_channel?.date_time != null && ctx?.zoom?.chat_channel?.timestamp == null"
+    ignore_failure: true
+- remove:
+    field: zoom.chat_channel.timestamp
+    ignore_missing: true
+    if: ctx?.zoom?.chat_channel?.timestamp != null
+- foreach:
+    field: zoom.chat_channel.members
+    processor:
+      append:
+        field: related.user
+        value: "{{_ingest._value.id}}"
+# Removing to prevent nested values, added to related.user above
+- remove:
+    field: zoom.chat_channel.members
+    ignore_missing: true
+on_failure:
+- set:
+    field: error.message
+    value: '{{ _ingest.on_failure_message }}'

packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/chat_message.yml

@@ -0,0 +1,51 @@
+---
+description: Pipeline for parsing Zoom chat_message webhooks
+processors:
+- append:
+    field: event.type
+    value: info
+- append:
+    field: event.type
+    value: creation
+    if: ctx?.event?.action == 'chat_message.sent'
+- append:
+    field: event.type
+    value: deletion
+    if: ctx?.event?.action == 'chat_message.deleted'
+- append:
+    field: event.type
+    value: change
+    if: ctx?.event?.action == 'chat_message.updated'
+- rename:
+    field: zoom.object
+    target_field: zoom.chat_message
+    ignore_missing: true
+- append:
+    field: related.user
+    value: "{{zoom.chat_message.contact_id}}"
+    if: "ctx?.zoom?.chat_message?.contact_id != null"
+- date:
+    field: zoom.chat_message.timestamp
+    target_field: '@timestamp'
+    formats:
+    - UNIX_MS
+    if: ctx?.zoom?.chat_message?.timestamp != null
+    ignore_failure: true
+- remove:
+    field: zoom.chat_message.date_time
+    ignore_missing: true
+    if: ctx?.zoom?.chat_message?.timestamp != null
+- date:
+    field: zoom.chat_message.date_time
+    target_field: '@timestamp'
+    formats:
+    - ISO_INSTANT
+    if: ctx?.zoom?.chat_message?.timestamp == null
+    ignore_failure: true
+- remove:
+    field: zoom.chat_message.timestamp
+    ignore_missing: true
+on_failure:
+- set:
+    field: error.message
+    value: '{{ _ingest.on_failure_message }}'

packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml

@@ -0,0 +1,97 @@
+---
+description: Initial pipeline for parsing Zoom webhooks
+processors:
+- set:
+    field: observer.vendor
+    value: Zoom
+- set:
+    field: observer.product
+    value: Webhook
+- set:
+    field: event.ingested
+    value: '{{_ingest.timestamp}}'
+- append:
+    field: event.kind
+    value: event
+- rename:
+    field: zoom.event
+    target_field: event.action
+    ignore_missing: true
+- rename:
+    field: zoom.payload
+    target_field: _temp_.payload
+- remove:
+    field: zoom
+- rename:
+    field: _temp_.payload
+    target_field: zoom
+- rename:
+    field: zoom.old_object
+    target_field: zoom.old_values
+    ignore_missing: true
+- rename:
+    field: zoom.object.participant
+    target_field: zoom.participant
+    ignore_missing: true
+- rename:
+    field: zoom.object.settings
+    target_field: zoom.settings
+    ignore_missing: true
+- rename:
+    field: zoom.object.registrant
+    target_field: zoom.registrant
+    ignore_missing: true
+- append:
+    field: related.user
+    value: "{{zoom.operator_id}}"
+    if: "ctx?.zoom?.operator_id != null"
+# Removing some fields that have complex nested arrays that might impact performance
+- remove:
+    field:
+    - message
+    - _temp_
+    - zoom.object.occurrences
+    - zoom.old_values.occurrences
+    - zoom.object.recurrence
+    - zoom.old_values.recurrence
+    - zoom.object.managed_domains
+    - zoom.old_values.managed_domains
+    - zoom.registrant.custom_questions
+    - zoom.old_values.registrant.custom_questions
+    - zoom.object.call_logs
+    - zoom.old_values.call_logs
+    - zoom.object.recording_files
+    - zoom.old_values.recording_files
+    - zoom.object.call_logs
+    ignore_missing: true
+- pipeline:
+    name: '{{ IngestPipeline "meeting" }}'
+    if: "ctx?.event?.action.startsWith('meeting')"
+- pipeline:
+    name: '{{ IngestPipeline "account" }}'
+    if: "ctx?.event?.action.startsWith('account')"
+- pipeline:
+    name: '{{ IngestPipeline "chat_message" }}'
+    if: "ctx?.event?.action.startsWith('chat_message')"
+- pipeline:
+    name: '{{ IngestPipeline "chat_channel" }}'
+    if: "ctx?.event?.action.startsWith('chat_channel')"
+- pipeline:
+    name: '{{ IngestPipeline "phone" }}'
+    if: "ctx?.event?.action.startsWith('phone')"
+- pipeline:
+    name: '{{ IngestPipeline "recording" }}'
+    if: "ctx?.event?.action.startsWith('recording')"
+- pipeline:
+    name: '{{ IngestPipeline "user" }}'
+    if: "ctx?.event?.action.startsWith('user')"
+- pipeline:
+    name: '{{ IngestPipeline "webinar" }}'
+    if: "ctx?.event?.action.startsWith('webinar')"
+- pipeline:
+    name: '{{ IngestPipeline "zoomroom" }}'
+    if: "ctx?.event?.action.startsWith('zoomroom')"
+on_failure:
+- set:
+    field: error.message
+    value: '{{ _ingest.on_failure_message }}'