Skip to content

Commit 25d90ad

Browse files
amirbenunamirbenun
committed
Merge branch 'main' into azure-integration-cloud-connector-type
2 parents 6e29f38 + 189ce33 commit 25d90ad

File tree

36 files changed

+165
-120
lines changed

36 files changed

+165
-120
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ require (
1313
github.com/magefile/mage v1.15.0
1414
github.com/pkg/errors v0.9.1
1515
github.com/stretchr/testify v1.11.1
16-
golang.org/x/mod v0.27.0
16+
golang.org/x/mod v0.28.0
1717
golang.org/x/tools v0.36.0
1818
gopkg.in/yaml.v3 v3.0.1
1919
)

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -677,8 +677,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
677677
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
678678
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
679679
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
680-
golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
681-
golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
680+
golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
681+
golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
682682
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
683683
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
684684
golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=

‎packages/cisco_asa/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.43.8"
3+
changes:
4+
- description: Support special characters in interface name in 315011 messages.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15242
27
- version: "2.43.7"
38
changes:
49
- description: Support IPv6 addresses in 750002 and 750003 messages.

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ May 5 19:02:25 dev01: %ASA-6-716039: Group <malcorp group> User <malory> IP <17
128128
<140>Oct 03 2023 16:40:40 myAsaHostname : %ASA-6-315011: SSH session from 10.1.2.1 on interface inside for user USER_1 disconnected by SSH server, reason: Out of memory
129129
<140>Oct 03 2023 16:40:40 myAsaHostname : %ASA-6-315011: SSH session from 10.1.2.3 on interface inside for user "user-test" terminated normally.
130130
<140>Oct 03 2023 16:40:40 myAsaHostname : %ASA-6-315011: SSH session from 10.1.2.3 on interface inside for user "*****" disconnected by SSH server, reason: "Time-out activated" (0x91)
131+
<140>Oct 03 2023 16:40:40 myAsaHostname : %ASA-6-315011: SSH session from 10.1.2.3 on interface int-with-hyphen for user "user-test" terminated normally.
131132
<140>Oct 03 2023 16:40:40 myAsaHostname : %ASA-6-721016: (DEVICE_1) WebVPN session for client user USER_1, IP 10.20.0.1 has been created.
132133
<140>Oct 03 2023 16:40:40 myAsaHostname : %ASA-6-721018: (DEVICE_1) WebVPN session for client user USER_1, IP 10.20.0.1 has been deleted.
133134
<140>Oct 03 2023 16:40:40 myAsaHostname : %ASA-5-722028: Group <GROUP 1> User <USER 1> IP <10.20.0.1> Stale SVC connection closed.

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9159,6 +9159,78 @@
91599159
"preserve_original_event"
91609160
]
91619161
},
9162+
{
9163+
"@timestamp": "2023-10-03T16:40:40.000Z",
9164+
"cisco": {
9165+
"asa": {
9166+
"source_interface": "int-with-hyphen"
9167+
}
9168+
},
9169+
"ecs": {
9170+
"version": "8.17.0"
9171+
},
9172+
"event": {
9173+
"action": "ssh-session-ended",
9174+
"category": [
9175+
"network"
9176+
],
9177+
"code": "315011",
9178+
"kind": "event",
9179+
"original": "<140>Oct 03 2023 16:40:40 myAsaHostname : %ASA-6-315011: SSH session from 10.1.2.3 on interface int-with-hyphen for user \"user-test\" terminated normally.",
9180+
"severity": 6,
9181+
"timezone": "UTC",
9182+
"type": [
9183+
"connection",
9184+
"end"
9185+
]
9186+
},
9187+
"host": {
9188+
"hostname": "myAsaHostname"
9189+
},
9190+
"log": {
9191+
"level": "informational",
9192+
"syslog": {
9193+
"facility": {
9194+
"code": 17
9195+
},
9196+
"priority": 140,
9197+
"severity": {
9198+
"code": 4
9199+
}
9200+
}
9201+
},
9202+
"observer": {
9203+
"hostname": "myAsaHostname",
9204+
"ingress": {
9205+
"interface": {
9206+
"name": "int-with-hyphen"
9207+
}
9208+
},
9209+
"product": "asa",
9210+
"type": "firewall",
9211+
"vendor": "Cisco"
9212+
},
9213+
"related": {
9214+
"hosts": [
9215+
"myAsaHostname"
9216+
],
9217+
"ip": [
9218+
"10.1.2.3"
9219+
],
9220+
"user": [
9221+
"user-test"
9222+
]
9223+
},
9224+
"source": {
9225+
"ip": "10.1.2.3",
9226+
"user": {
9227+
"name": "user-test"
9228+
}
9229+
},
9230+
"tags": [
9231+
"preserve_original_event"
9232+
]
9233+
},
91629234
{
91639235
"@timestamp": "2023-10-03T16:40:40.000Z",
91649236
"cisco": {

‎packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -669,8 +669,8 @@ processors:
669669
field: "message"
670670
description: "315011"
671671
patterns:
672-
- 'SSH session from %{IP:source.ip} on interface %{WORD:_temp_.cisco.source_interface} for user %{CISCO_USER} disconnected by SSH server, reason: %{GREEDYDATA:event.reason}'
673-
- 'SSH session from %{IP:source.ip} on interface %{WORD:_temp_.cisco.source_interface} for user %{CISCO_USER} terminated normally'
672+
- 'SSH session from %{IP:source.ip} on interface %{NOTSPACE:_temp_.cisco.source_interface} for user %{CISCO_USER} disconnected by SSH server, reason: %{GREEDYDATA:event.reason}'
673+
- 'SSH session from %{IP:source.ip} on interface %{NOTSPACE:_temp_.cisco.source_interface} for user %{CISCO_USER} terminated normally'
674674
pattern_definitions:
675675
CISCO_USER: '\"?(?:\*{5}|%{USERNAME:source.user.name})\"?'
676676
- dissect:

‎packages/cisco_asa/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.3"
22
name: cisco_asa
33
title: Cisco ASA
4-
version: "2.43.7"
4+
version: "2.43.8"
55
description: Collect logs from Cisco ASA with Elastic Agent.
66
type: integration
77
categories:

‎packages/dga/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.3.3"
3+
changes:
4+
- description: Remove instructions to change the `default_pipeline` for an index
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15229
27
- version: "2.3.2"
38
changes:
49
- description: Correct typo in Readme

‎packages/dga/docs/README.md‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,6 @@ For more detailed information refer to the following blogs:
6060
```
6161
- If the `@custom` component template already exists, you will need to edit it to add mappings for data to be properly enriched. Click the three dots next to it and select **Edit**.
6262
![Component Templates](../img/component-templates-edit.png)
63-
- On the index settings step, add the following. Be sure to change `<VERSION>` to the current package version.
64-
```
65-
{
66-
"index": {
67-
"default_pipeline": "<VERSION>-ml_dga_ingest_pipeline"
68-
}
69-
}
70-
```
7163
- Proceed to the mappings step in the UI. Click **Add Field** at the bottom of the page and create an an `Object` field for `ml_is_dga`.
7264
![Component Templates](../img/field1.png)
7365
- Finally create two properties under `ml_is_dga`.

‎packages/dga/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.0.4
22
name: dga
33
title: "Domain Generation Algorithm Detection"
4-
version: 2.3.2
4+
version: 2.3.3
55
source:
66
license: "Elastic-2.0"
77
description: "ML solution package to detect domain generation algorithm (DGA) activity in your network data."

0 commit comments

Comments
 (0)