Spring boot package [Audit events - data stream] by sunny-elastic · Pull Request #2977 · elastic/integrations

sunny-elastic · 2022-04-03T07:43:44Z

What does this PR do?

Generated the skeleton of Spring Boot integration package.
Added Audit events data stream
Added data collection logic.
Added the ingest pipelines.
Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files.
Added system test cases.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that Audit events data stream collect logs.
I have added an entry to my package's changelog.yml file.
If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^8.0.0).

How to test this PR locally

Clone integrations repo.
Install elastic-package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/spring_boot directory.
Run the following command to run tests.

elastic-package test

Note: We have covered dashboards and the visualisations for all data streams of spring boot into separate PR. Also Kibana version will be updated to 8.1.0 in manifest.yml after testing this integration on 8.1.0.

elasticmachine · 2022-04-03T07:57:11Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-04-14T14:03:05.891+0000
Duration: 15 min 10 sec

Test stats 🧪

Test	Results
Failed	0
Passed	5
Skipped	0
Total	5

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

elasticmachine · 2022-04-03T12:41:06Z

Pinging @elastic/integrations (Team:Integrations)

mtojek · 2022-04-04T09:31:37Z

+- name: spring_boot
+  type: group
+  fields:
+    - name: auditevents


This is inconsistent with the data_stream name.

@sunny-elastic can you use the data stream name here?

mtojek · 2022-04-14T11:24:06Z

+          fields:
+            - name: remote_address
+              type: keyword
+              description: Remote Address of the Spring Boot application


Remote address of the application or user?

As this field got extracted from event.original as we addressed in previous comment. And this looks remote address of user.

Just to be sure, could you please double-check it with Spring docs or source code? Usually, you don't collect server IP address, but user IP, hence I'm confused.

yes its user ip address and not the server ip address.

mtojek · 2022-04-14T11:24:22Z

+              description: Remote Address of the Spring Boot application
+            - name: session_id
+              type: keyword
+              description: Session ID of the Spring Boot application


Session ID of user or application?

As this field got extracted from event.original as we addressed in previous comment. And this looks session id of user

If this field concerns the user, let's rephrase the description accordingly.

mtojek · 2022-04-14T11:25:00Z

+              description: Session ID of the Spring Boot application
+        - name: principal
+          type: keyword
+          description: Restricts the events to those with the given principal


Could you please rephrase it? I'm not sure that I understand what is this field about.

So here this principal is basically referring to the user. and those remote address and session id fields for that specific principal that is user.

mtojek · 2022-04-14T12:49:24Z

+            "spring_boot": {
+                "audit_events": {
+                    "data": {
+                        "session_id": "192.168.32.6"


Why session ID is IP address? Did you dump this event or prepared manually?

mtojek · 2022-04-14T12:51:44Z

+          fields:
+            - name: remote_address
+              type: keyword
+              description: Remote Address of the Spring Boot application


Just to be sure, could you please double-check it with Spring docs or source code? Usually, you don't collect server IP address, but user IP, hence I'm confused.

sunny-elastic · 2022-04-14T13:11:37Z

@mtojek yes remote_address refer to the user ip address and not the server ip address.

mtojek · 2022-04-14T13:18:55Z

Thanks for checking this. Could you please post a link to the documentation or Spring Boot source, in case somebody in the future will have similar concerns?

sunny-elastic · 2022-04-14T13:51:34Z

Thanks for checking this. Could you please post a link to the documentation or Spring Boot source, in case somebody in the future will have similar concerns?

yeah sure. so here are few links for spring boot documentation for audit events
https://docs.spring.io/spring-boot/docs/current/api/org/springframework/boot/actuate/audit/AuditEvent.html
https://docs.spring.io/spring-boot/docs/2.6.3/actuator-api/htmlsingle/#audit-events

mtojek · 2022-04-14T13:57:17Z

@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: git@8.0


I think you can update it to 8.1, as you're setting the ecs.version in the pipeline to 8.1.0.

Done. fixed. Thanks!

mtojek

LGTM. Feel free to merge it if CI is happy.

* Spring boot package [Audit events - data stream] * Update as per review comments * update README.md * update CODEOWNERS and manifest * updated code according to review comments * updated README.md * update git ecs version Co-authored-by: yug-elastic <96041884+yug-elastic@users.noreply.github.com>

Spring boot package [Audit events - data stream]

1c92a0a

sunny-elastic requested a review from a team as a code owner April 3, 2022 07:43

sunny-elastic requested a review from mtojek April 3, 2022 07:58

sunny-elastic self-assigned this Apr 3, 2022

sunny-elastic added enhancement New feature or request Team:Integrations Label for the Integrations team New Integration Issue or pull request for creating a new integration package. labels Apr 3, 2022

mtojek requested a review from ruflin April 4, 2022 09:35

mtojek reviewed Apr 4, 2022

View reviewed changes

sunny-elastic and others added 6 commits April 4, 2022 20:05

Merge branch 'elastic:main' into package_spring_boot_audit_events

5991162

Merge branch 'elastic:main' into package_spring_boot_audit_events

68f8bf1

Update as per review comments

18ea5e7

update README.md

f01d922

Merge branch 'elastic:main' into package_spring_boot_audit_events

24b9bf6

update CODEOWNERS and manifest

faa8a8a

mtojek suggested changes Apr 14, 2022

View reviewed changes

sunny-elastic added 2 commits April 14, 2022 18:59

updated code according to review comments

1fbfd99

updated README.md

8657727

sunny-elastic requested a review from mtojek April 14, 2022 13:32

mtojek suggested changes Apr 14, 2022

View reviewed changes

update git ecs version

a0c75e6

mtojek self-requested a review April 14, 2022 14:11

mtojek approved these changes Apr 14, 2022

View reviewed changes

sunny-elastic merged commit f0dda6d into elastic:main Apr 14, 2022

Navigation Menu

Uh oh!

Spring boot package [Audit events - data stream] - #2977

Spring boot package [Audit events - data stream]#2977
sunny-elastic merged 10 commits into
elastic:mainfrom
sunny-elastic:package_spring_boot_audit_events

sunny-elastic commented Apr 3, 2022 •

edited

Loading

elasticmachine commented Apr 3, 2022 •

edited

Loading

Build stats

Test stats 🧪

elasticmachine commented Apr 3, 2022

Uh oh!

mtojek Apr 4, 2022

masci Apr 14, 2022

sunny-elastic Apr 14, 2022

Uh oh!

Uh oh!

mtojek Apr 14, 2022

sunny-elastic Apr 14, 2022 •

edited

Loading

mtojek Apr 14, 2022

sunny-elastic Apr 14, 2022

mtojek Apr 14, 2022

sunny-elastic Apr 14, 2022 •

edited

Loading

mtojek Apr 14, 2022

mtojek Apr 14, 2022

sunny-elastic Apr 14, 2022

mtojek Apr 14, 2022

mtojek Apr 14, 2022

sunny-elastic commented Apr 14, 2022

mtojek commented Apr 14, 2022

sunny-elastic commented Apr 14, 2022

mtojek Apr 14, 2022

sunny-elastic Apr 14, 2022

mtojek left a comment

Labels

5 participants

Uh oh!

Conversation

sunny-elastic commented Apr 3, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Checklist

How to test this PR locally

elasticmachine commented Apr 3, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

elasticmachine commented Apr 3, 2022

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

sunny-elastic Apr 14, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sunny-elastic Apr 14, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sunny-elastic commented Apr 14, 2022

mtojek commented Apr 14, 2022

sunny-elastic commented Apr 14, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mtojek left a comment

Choose a reason for hiding this comment

Labels

5 participants

sunny-elastic commented Apr 3, 2022 •

edited

Loading

elasticmachine commented Apr 3, 2022 •

edited

Loading

sunny-elastic Apr 14, 2022 •

edited

Loading

sunny-elastic Apr 14, 2022 •

edited

Loading