Skip to content

cisco_duo: fix handling of IP addresses with port numbers - #3117

Merged
efd6 merged 4 commits into
elastic:mainfrom
efd6:3101-ciscoduo
Apr 21, 2022
Merged

cisco_duo: fix handling of IP addresses with port numbers#3117
efd6 merged 4 commits into
elastic:mainfrom
efd6:3101-ciscoduo

Conversation

@efd6

@efd6 efd6 commented Apr 19, 2022

Copy link
Copy Markdown
Contributor

What does this PR do?

Fixes handling of addresses with port numbers.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@efd6 efd6 added bug Something isn't working, use only for issues Team:Security-External Integrations Integration:cisco_duo Cisco Duo labels Apr 19, 2022
@efd6
efd6 requested a review from a team as a code owner April 19, 2022 02:48
@efd6 efd6 self-assigned this Apr 19, 2022
@elasticmachine

elasticmachine commented Apr 19, 2022

Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
efd6
efd6 commented Apr 19, 2022
View reviewed changes
Comment thread packages/cisco_duo/changelog.yml Outdated
@elasticmachine

elasticmachine commented Apr 19, 2022 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-04-21T22:03:46.781+0000

  • Duration: 18 min 56 sec

Test stats 🧪

Test Results
Failed 0
Passed 54
Skipped 0
Total 54

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
andrewkroh
andrewkroh reviewed Apr 19, 2022
View reviewed changes
Comment thread packages/cisco_duo/data_stream/auth/elasticsearch/ingest_pipeline/default.yml Outdated
@efd6
efd6 requested a review from andrewkroh April 21, 2022 00:45
andrewkroh
andrewkroh approved these changes Apr 21, 2022
View reviewed changes
Comment thread packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-auth.log
{"access_device":{"browser":"Chrome","browser_version":"92.0.4515.131","flash_version":"uninstalled","hostname":null,"ip":"89.160.20.156","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Windows","os_version":"10"},"alias":"","application":{"key":"DIY231J8BR23QK4UKBY8","name":"Duo Access Gateway Launcher"},"auth_device":{"ip":"89.160.20.156","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"+91 12345 12345"},"email":"narroway@example.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2021-08-12T09:14:23.060168+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1628759663,"txid":"861a81e7-1f60-4865-95eb-57d9c43ce073","user":{"groups":["AD Sync"],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway"}}
{"access_device":{"browser":"Chrome","browser_version":"92.0.4515.107","flash_version":"uninstalled","hostname":null,"ip":"89.160.20.156","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Windows","os_version":"10"},"alias":"","application":{"key":"DIY231J8BR23QK4UKBY8","name":"Duo Access Gateway Launcher"},"auth_device":{"ip":"89.160.20.156","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"+91 12345 12345"},"email":"","event_type":"authentication","factor":"duo_push","isotimestamp":"2021-07-23T07:20:54.700050+00:00","ood_software":null,"reason":"user_marked_fraud","result":"fraud","timestamp":1627024854,"txid":"78e1a910-350b-4226-828b-edb0ac2f2e3c","user":{"groups":["AD Sync"],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway"}}
{"access_device":{"browser":"Chrome","browser_version":"92.0.4515.107","flash_version":"uninstalled","hostname":null,"ip":"89.160.20.156","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Windows","os_version":"10"},"alias":"","application":{"key":"DIY231J8BR23QK4UKBY8","name":"Duo Access Gateway Launcher"},"auth_device":{"ip":"89.160.20.156","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"+91 12345 12345"},"email":"","event_type":"authentication","factor":"duo_push","isotimestamp":"2021-07-23T07:19:34.702203+00:00","ood_software":null,"reason":"user_mistake","result":"denied","timestamp":1627024774,"txid":"e22120cd-7388-424f-aa0a-b60cad42d8f3","user":{"groups":["AD Sync"],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway"}} No newline at end of file
{"access_device":{"browser":"Chrome","browser_version":"92.0.4515.107","flash_version":"uninstalled","hostname":null,"ip":"89.160.20.156","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Windows","os_version":"10"},"alias":"","application":{"key":"DIY231J8BR23QK4UKBY8","name":"Duo Access Gateway Launcher"},"auth_device":{"ip":"89.160.20.156","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"+91 12345 12345"},"email":"","event_type":"authentication","factor":"duo_push","isotimestamp":"2021-07-23T07:19:34.702203+00:00","ood_software":null,"reason":"user_mistake","result":"denied","timestamp":1627024774,"txid":"e22120cd-7388-424f-aa0a-b60cad42d8f3","user":{"groups":["AD Sync"],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway"}}

@andrewkroh andrewkroh Apr 21, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, you've got all of the formats covered.
@efd6
efd6 merged commit edf13fb into elastic:main Apr 21, 2022
@efd6
efd6 deleted the 3101-ciscoduo branch April 21, 2022 22:23
@efd6 efd6 mentioned this pull request Apr 22, 2022
Merged
4 tasks
v1v added a commit to v1v/integrations that referenced this pull request Apr 25, 2022
@v1v
'feature/labels-cloud-ephemeral-components' of github.com:v1v/integr…
02b4c7f 
…ations into feature/labels-cloud-ephemeral-components

* 'feature/labels-cloud-ephemeral-components' of github.com:v1v/integrations: (23 commits)
  use branch
  standardise labels/tags
  Update .ci/Jenkinsfile
  [ci][terraform][aws] tags with metadata
  Bump github.com/elastic/elastic-package from 0.46.0 to 0.47.0 (elastic#3182)
  Spring boot package [Memory - data stream] (elastic#2979)
  [cisco_ise] Add Cisco ISE package (elastic#2855)
  [apache_spark][executor] Add Apache Spark package with Executor data stream (elastic#2943)
  [apache_spark][driver] Add Apache Spark package with Driver data stream (elastic#2945)
  cisco_duo: simplify grok expression for handling ports (elastic#3170)
  cisco_duo: fix handling of IP addresses with port numbers (elastic#3117)
  [sophos] Various improvements and log samples from 18.5 (elastic#3127)
  [cisco_asa] fix visualizations (elastic#3146)
  [apache_spark][application] Add Apache Spark package with Application data stream (elastic#2941)
  Fix pagination bug that skipped events when more than one page is present. (elastic#3140)
  Cis k8s name migration (elastic#3113)
  remove exported fields; these will be added to Kibana docs instead (elastic#3093)
  Exclude ecosystem as owner of subdirectories of packages (elastic#3132)
  [awsfargate] bump package version (elastic#3130)
  add first csp rule template (elastic#3081)
  ...
@efd6 efd6 mentioned this pull request Apr 26, 2022
Merged
5 tasks
@andrewkroh andrewkroh mentioned this pull request May 2, 2022
Merged
@gsantoro gsantoro mentioned this pull request Sep 6, 2022
Closed
@andrewkroh andrewkroh mentioned this pull request Sep 6, 2022
Merged
6 tasks
@efd6 efd6 mentioned this pull request Sep 6, 2022
Merged
4 tasks
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@efd6
cisco_duo: fix handling of IP addresses with port numbers (elastic#3117)
616a490
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working, use only for issues Integration:cisco_duo Cisco Duo

3 participants

@efd6 @elasticmachine @andrewkroh