Skip to content

Commit 2b74cc9

Browse files
kgellerkgeller
authored
[ECS] Updating keycloak to ECS 8.10 & ECS field validation updates (#7928)
* Correcting ecs field validation & updating to ecs 8.10 * Update changelog.yml * Update changelog.yml
1 parent 49ba2f2 commit 2b74cc9

File tree

6 files changed

+36
-43
lines changed

6 files changed

+36
-43
lines changed

‎packages/keycloak/_dev/build/build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
dependencies:
22
ecs:
3-
reference: git@v8.9.0
3+
reference: git@v8.10.0

‎packages/keycloak/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.14.0"
3+
changes:
4+
- description: Update package to ECS 8.10.0 and align ECS categorization fields.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/7928
27
- version: "1.13.0"
38
changes:
49
- description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.

‎packages/keycloak/data_stream/log/_dev/test/pipeline/test-log.log-expected.json‎

Lines changed: 28 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
{
44
"@timestamp": "2021-10-22T21:01:42.548-05:00",
55
"ecs": {
6-
"version": "8.9.0"
6+
"version": "8.10.0"
77
},
88
"event": {
99
"original": "2021-10-22 21:01:42,548 INFO [org.keycloak.services] (ServerService Thread Pool -- 64) KC-SERVICES0009: Added user 'admin' to realm 'master'",
@@ -26,7 +26,7 @@
2626
{
2727
"@timestamp": "2021-10-22T21:01:42.667-05:00",
2828
"ecs": {
29-
"version": "8.9.0"
29+
"version": "8.10.0"
3030
},
3131
"event": {
3232
"original": "2021-10-22 21:01:42,667 INFO [org.jboss.resteasy.resteasy_jaxrs.i18n] (ServerService Thread Pool -- 64) RESTEASY002220: Adding singleton resource org.keycloak.services.resources.admin.AdminRoot from Application class org.keycloak.services.resources.KeycloakApplication",
@@ -49,7 +49,7 @@
4949
{
5050
"@timestamp": "2021-10-22T21:01:42.912-05:00",
5151
"ecs": {
52-
"version": "8.9.0"
52+
"version": "8.10.0"
5353
},
5454
"event": {
5555
"original": "2021-10-22 21:01:42,912 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 64) WFLYUT002021-10-22 21: Registered web context: '/auth' for server 'default-server' ",
@@ -72,7 +72,7 @@
7272
{
7373
"@timestamp": "2021-10-22T21:01:43.208-05:00",
7474
"ecs": {
75-
"version": "8.9.0"
75+
"version": "8.10.0"
7676
},
7777
"event": {
7878
"original": "2021-10-22 21:01:43,208 INFO [org.jboss.as.server] (ServerService Thread Pool -- 46) WFLYSRV0010: Deployed \"keycloak-server.war\" (runtime-name : \"keycloak-server.war\") ",
@@ -95,7 +95,7 @@
9595
{
9696
"@timestamp": "2021-10-22T21:01:43.299-05:00",
9797
"ecs": {
98-
"version": "8.9.0"
98+
"version": "8.10.0"
9999
},
100100
"event": {
101101
"original": "2021-10-22 21:01:43,299 INFO [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0212: Resuming server",
@@ -118,7 +118,7 @@
118118
{
119119
"@timestamp": "2021-10-22T21:01:43.307-05:00",
120120
"ecs": {
121-
"version": "8.9.0"
121+
"version": "8.10.0"
122122
},
123123
"event": {
124124
"original": "2021-10-22 21:01:43,307 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0025: Keycloak 15.0.2 (WildFly Core 15.0.1.Final) started in 28315ms - Started 692 of 977 services (686 services are lazy, passive or on-demand)",
@@ -141,7 +141,7 @@
141141
{
142142
"@timestamp": "2021-10-22T21:01:43.327-05:00",
143143
"ecs": {
144-
"version": "8.9.0"
144+
"version": "8.10.0"
145145
},
146146
"event": {
147147
"original": "2021-10-22 21:01:43,327 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0060: Http management interface listening on http://127.0.0.1:9990/management",
@@ -164,7 +164,7 @@
164164
{
165165
"@timestamp": "2021-10-22T21:01:43.327-05:00",
166166
"ecs": {
167-
"version": "8.9.0"
167+
"version": "8.10.0"
168168
},
169169
"event": {
170170
"original": "2021-10-22 21:01:43,327 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0051: Admin console listening on http://127.0.0.1:9990",
@@ -187,7 +187,7 @@
187187
{
188188
"@timestamp": "2021-10-22T21:01:45.403-05:00",
189189
"ecs": {
190-
"version": "8.9.0"
190+
"version": "8.10.0"
191191
},
192192
"event": {
193193
"action": "LOGIN_ERROR",
@@ -199,8 +199,7 @@
199199
"original": "2021-10-22 21:01:45,403 WARN [org.keycloak.events] (default task-1) type=LOGIN_ERROR, realmId=test, clientId=test, userId=null, ipAddress=172.18.0.1, error=invalid_redirect_uri, redirect_uri=http://localhost:8080",
200200
"timezone": "America/Chicago",
201201
"type": [
202-
"info",
203-
"denied"
202+
"info"
204203
]
205204
},
206205
"keycloak": {
@@ -250,7 +249,7 @@
250249
{
251250
"@timestamp": "2021-10-22T21:20:42.120-05:00",
252251
"ecs": {
253-
"version": "8.9.0"
252+
"version": "8.10.0"
254253
},
255254
"event": {
256255
"action": "LOGIN_ERROR",
@@ -262,8 +261,7 @@
262261
"original": "2021-10-22 21:20:42,120 WARN [org.keycloak.events] (default task-2) type=LOGIN_ERROR, realmId=test, clientId=test, userId=cc74404c-de7e-482a-98f7-b271ff3c49be, ipAddress=172.18.0.1, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, redirect_uri=http://127.0.0.1:8080, code_id=3a76b735-e324-42b1-aa15-7c1f69f22eb8, username=admin, authSessionParentId=3a76b735-e324-42b1-aa15-7c1f69f22eb8, authSessionTabId=oJpF-WjDC04",
263262
"timezone": "America/Chicago",
264263
"type": [
265-
"info",
266-
"denied"
264+
"info"
267265
]
268266
},
269267
"keycloak": {
@@ -325,7 +323,7 @@
325323
{
326324
"@timestamp": "2021-10-22T21:24:41.076-05:00",
327325
"ecs": {
328-
"version": "8.9.0"
326+
"version": "8.10.0"
329327
},
330328
"event": {
331329
"action": "LOGIN_ERROR",
@@ -337,8 +335,7 @@
337335
"original": "2021-10-22 21:24:41,076 WARN [org.keycloak.events] (default task-10) type=LOGIN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress=172.18.0.1, error=user_not_found, auth_method=openid-connect, auth_type=code, redirect_uri=http://127.0.0.1:9090/auth/admin/master/console/, code_id=f9d4300d-d052-4eb6-9aeb-e8fcf642a21f, authSessionParentId=f9d4300d-d052-4eb6-9aeb-e8fcf642a21f, authSessionTabId=C8EtUrcFMsg",
338336
"timezone": "America/Chicago",
339337
"type": [
340-
"info",
341-
"denied"
338+
"info"
342339
]
343340
},
344341
"keycloak": {
@@ -394,7 +391,7 @@
394391
{
395392
"@timestamp": "2021-10-22T21:31:31.555-05:00",
396393
"ecs": {
397-
"version": "8.9.0"
394+
"version": "8.10.0"
398395
},
399396
"event": {
400397
"action": "LOGIN_ERROR",
@@ -406,8 +403,7 @@
406403
"original": "2021-10-22 21:31:31,555 WARN [org.keycloak.events] (default task-10) type=LOGIN_ERROR, realmId=test, clientId=test, userId=null, ipAddress=172.18.0.1, error=invalid_redirect_uri, redirect_uri=http://localhost:8080",
407404
"timezone": "America/Chicago",
408405
"type": [
409-
"info",
410-
"denied"
406+
"info"
411407
]
412408
},
413409
"keycloak": {
@@ -457,7 +453,7 @@
457453
{
458454
"@timestamp": "2021-10-22T20:58:02.700-05:00",
459455
"ecs": {
460-
"version": "8.9.0"
456+
"version": "8.10.0"
461457
},
462458
"event": {
463459
"action": "LOGIN_ERROR",
@@ -469,8 +465,7 @@
469465
"original": "2021-10-22 20:58:02,700 WARN [org.keycloak.events] (default task-18) type=LOGIN_ERROR, realmId=ABCD TEST, clientId=https://www.example.com/shibboleth, userId=ce637d23-b89c-4fca-9088-1aea1d053e19, ipAddress=10.2.2.156, error=invalid_user_credentials, auth_method=saml, redirect_uri=https://www.example.com/Shibboleth.sso/SAML2/POST, code_id=cbefe0ca-bc11-48b4-b7fa-f1a59d220980, username=admin, authSessionParentId=cbefe0ca-bc11-48b4-b7fa-f1a59d220980, authSessionTabId=97qImXws36A",
470466
"timezone": "America/Chicago",
471467
"type": [
472-
"info",
473-
"denied"
468+
"info"
474469
]
475470
},
476471
"keycloak": {
@@ -532,7 +527,7 @@
532527
{
533528
"@timestamp": "2021-10-22T22:11:31.257-05:00",
534529
"ecs": {
535-
"version": "8.9.0"
530+
"version": "8.10.0"
536531
},
537532
"event": {
538533
"action": "LOGIN",
@@ -544,8 +539,7 @@
544539
"timezone": "America/Chicago",
545540
"type": [
546541
"info",
547-
"start",
548-
"allowed"
542+
"start"
549543
]
550544
},
551545
"keycloak": {
@@ -608,7 +602,7 @@
608602
{
609603
"@timestamp": "2021-10-22T22:11:32.131-05:00",
610604
"ecs": {
611-
"version": "8.9.0"
605+
"version": "8.10.0"
612606
},
613607
"event": {
614608
"action": "CODE_TO_TOKEN",
@@ -666,7 +660,7 @@
666660
{
667661
"@timestamp": "2021-10-22T22:12:09.871-05:00",
668662
"ecs": {
669-
"version": "8.9.0"
663+
"version": "8.10.0"
670664
},
671665
"event": {
672666
"action": "CREATE-USER",
@@ -734,7 +728,7 @@
734728
{
735729
"@timestamp": "2021-10-22T22:12:13.599-05:00",
736730
"ecs": {
737-
"version": "8.9.0"
731+
"version": "8.10.0"
738732
},
739733
"event": {
740734
"action": "UPDATE-USER",
@@ -802,7 +796,7 @@
802796
{
803797
"@timestamp": "2021-10-22T22:14:29.031-05:00",
804798
"ecs": {
805-
"version": "8.9.0"
799+
"version": "8.10.0"
806800
},
807801
"event": {
808802
"action": "CREATE-GROUP",
@@ -869,7 +863,7 @@
869863
{
870864
"@timestamp": "2021-10-22T22:16:12.150-05:00",
871865
"ecs": {
872-
"version": "8.9.0"
866+
"version": "8.10.0"
873867
},
874868
"event": {
875869
"action": "CREATE-CLIENT_SCOPE",
@@ -933,7 +927,7 @@
933927
{
934928
"@timestamp": "2021-10-22T22:45:12.592-05:00",
935929
"ecs": {
936-
"version": "8.9.0"
930+
"version": "8.10.0"
937931
},
938932
"event": {
939933
"action": "LOGOUT",
@@ -1001,7 +995,7 @@
1001995
{
1002996
"@timestamp": "2021-10-22T22:46:14.913-05:00",
1003997
"ecs": {
1004-
"version": "8.9.0"
998+
"version": "8.10.0"
1005999
},
10061000
"event": {
10071001
"action": "DELETE-GROUP",
@@ -1068,7 +1062,7 @@
10681062
{
10691063
"@timestamp": "2021-10-22T23:05:03.371-05:00",
10701064
"ecs": {
1071-
"version": "8.9.0"
1065+
"version": "8.10.0"
10721066
},
10731067
"event": {
10741068
"action": "CREATE-GROUP",

‎packages/keycloak/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ description: Pipeline for parsing keycloak logs
33
processors:
44
- set:
55
field: ecs.version
6-
value: '8.9.0'
6+
value: '8.10.0'
77
- rename:
88
field: message
99
target_field: event.original

‎packages/keycloak/data_stream/log/elasticsearch/ingest_pipeline/events.yml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -143,16 +143,10 @@ processors:
143143
field: event.type
144144
value:
145145
- info
146-
- append:
147-
field: event.type
148-
value:
149-
- denied
150-
if: ctx.keycloak?.login?.type == 'LOGIN_ERROR'
151146
- append:
152147
field: event.type
153148
value:
154149
- start
155-
- allowed
156150
if: ctx.keycloak?.login?.type == 'LOGIN'
157151
- append:
158152
field: event.type

‎packages/keycloak/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: keycloak
22
title: Keycloak
3-
version: "1.13.0"
3+
version: "1.14.0"
44
description: Collect logs from Keycloak with Elastic Agent.
55
type: integration
66
format_version: 2.11.0

0 commit comments

Comments
 (0)