Skip to content

Commit 5261127

Browse files
ash-darinash-darin
authored
[checkpoint] Expand and fix IANA number handling (#13568)
- Add handling of IANA protocol number 114. - Add handling of unknown IANA numbers. When no protocol.transport is set, dashboards for this integration simply do not show the traffic for that protocol. With adding the number as a fallback, these show up now. - Fix recognition of IANA protocol number 0. IANA protocol number 0 only translates to "hopopt" if the underlying protocol is IPv6. For IPv4 the number "0" is undefined ("reserved") and according to "/etc/protocols" in most Linux distributions is recognized to denote the internet protocol v4 itself. Labeling protocol number 0 as "hopopt" in general is therefore wrong.
1 parent 3b7b4cb commit 5261127

File tree

7 files changed

+140
-2
lines changed

7 files changed

+140
-2
lines changed

‎packages/checkpoint/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.40.0"
3+
changes:
4+
- description: Expand and fix iana number handling. Handle "iana_numer"/"port" 4294967295
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13568
27
- version: "1.39.0"
38
changes:
49
- description: Support stack version 9.0.

‎packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,5 @@
3333
<134>1 2025-01-21T09:36:10Z TEST_HOSTNAME CheckPoint 16953 - [action:"Prevent"; flags:"313600"; ifdir:"outbound"; ifname:"eth3-01"; loguid:"{0xae027eed,0xef89f5a0,0x5b806530,0x8b665bef}"; origin:"192.168.1.102"; originsicname:"CN=TESTWA022B001,O=TESTWM002001..t2z5yx"; sequencenum:"2"; time:"1737452170"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={C09DCBFA-7A2D-3C4C-AED3-92799BF04FA4};mgmt=TEST_HOSTNAME;date=1737129819;policy_name=TEST_Policy]"; dst:"192.168.5.152"; http_host:"192.168.32.48"; log_id:"2"; malware_rule_id:"{313A7B1F-5FB8-4608-B0F8-05A2311B6FFF}"; method:"GET"; policy:"TEST_Policy"; policy_time:"1737409154"; product:"SmartDefense"; proto:"6"; proxy_src_ip:"192.168.211.208"; reject_id_kid:"678f6a8a-30000-48715ce7-e71d8eea"; resource:"http://192.168.32.48/manager/html"; rule_name:"ITP-1402-3"; rule_uid:"e497b418-91b9-4514-b784-4809e3d5dbc2"; s_port:"35428"; ser_agent_kid:"Other: Mozilla/5.0 zgrab/0.x"; service:"80"; session_id:"{0x678f6a8a,0x30001,0x48715ce7,0xe71d8eea}"; smartdefense_profile:"Optimized"; src:"192.168.211.208"; layer_uuid:"{31A46FFD-A526-4318-BA17-49CBCDC38A14}"; malware_rule_id:"{313A7B1F-5FB8-4608-B0F8-05A2311B6FFF}"; smartdefense_profile:"Optimized"]
3434
<134>1 2025-01-21T09:37:10Z TEST_HOSTNAME CheckPoint 16953 - [flags:"278528"; ifdir:"inbound"; loguid:"{0xae027eed,0xef89f5a0,0x5b806530,0x8b665bef}"; origin:"192.168.1.102"; originsicname:"CN=TESTWA022B001,O=TESTWM002001..t2z5yx"; sequencenum:"2"; time:"1737452230"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={C09DCBFA-7A2D-3C4C-AED3-92799BF04FA4};mgmt=TEST_HOSTNAME;date=1737129819;policy_name=TEST_Policy]"; log_id:"2"; product:"SmartDefense"; received_bytes:"60"; sent_bytes:"0"; suppressed_logs:"1"]
3535
<134>1 2025-02-18T10:01:41Z TEST_HOSTNAME CheckPoint 10038 - [action:"Log In"; flags:"18688"; ifdir:"inbound"; loguid:"{0xae027eed,0xef89f5a0,0x5b806530,0x8b665bef}"; origin:"192.168.1.102"; originsicname:"CN=TESTWA022B001,O=TESTWM002001..t2z5yx"; sequencenum:"270"; time:"1739872901"; version:"5"; auth_method:"Password"; auth_method2:"DynamicID"; client_build:"986102607"; client_name:"Test Client"; client_version:"E123.123"; cvpn_category:"Session"; device_identification:"{313A7B1F-5FB8-4608-B0F8-05A2311B6FFF}"; domain_name:"EXAMPLE.LOCAL"; event_type:"Login"; failed_login_factor_num:"0"; host_ip:"10.1.1.1"; host_type:"PC"; hostname:"TEST_HOSTNAME"; lastupdatetime:"1739872901"; login_option:"two-way"; login_timestamp:"1739872901"; mac_address:"ab:cd:ef:01:23:45"; more:"authenticated_machine= (CN=TESTHOST1,OU=Test 2.0,OU=Testcomputers,DC=TEST,DC=LOCAL)"; office_mode_ip:"192.168.1.1"; os_bits:"64bit"; os_build:"19045"; os_edition:"Enterprise"; os_name:"Windows"; os_version:"10"; product:"Test Product"; proto:"6"; proxy_src_ip:"0.0.0.0"; s_port:"0"; service:"443"; session_timeout:"43174"; session_uid:"{31A46FFD-A526-4318-BA17-49CBCDC38A14}"; src:"192.168.211.208"; status:"Success"; suppressed_logs:"0"; tunnel_protocol:"IPSec"; user:" Test User "; user_dn:"CN=Test User,OU=Users,DC=test,DC=local"; user_group:"Users"]
36+
<134>1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 8363 - [action:"Reject"; flags:"44676"; ifdir:"inbound"; ifname:"daemon"; loguid:"{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}"; origin:"192.168.0.1"; originsicname:"CN=cp_mgmt,O=gw-da58d3..tmn8s8"; sequencenum:"22"; time:"1746521905"; version:"5"; dst:"0.0.0.0"; encryption_failure::"no response from peer."; fw_subproduct:"VPN-1"; peer_gateway:"192.168.10.1"; proto:"0"; reject_category:"IKE failure"; rule:"0"; s_port:"0"; scheme::"IKE"; service:"0"; src:"0.0.0.0"; vpn_feature_name:"IKE"]
37+
<134>1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 8363 - [action:"Detect"; flags:"44676"; ifdir:"inbound"; ifname:"eth0"; loguid:"{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}"; origin:"192.168.0.1"; originsicname:"CN=cp_mgmt,O=gw-da58d3..tmn8s8"; sequencenum:"22"; time:"1746491278"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1746456871;policy_name=Standard\]"; attack:"Port Scan"; attack_info:"Host Port Scan"; confidence_level:"5"; dst:"192.168.10.1"; performance_impact:"2"; product:"SmartDefense"; protection_id:"HostPortScan"; protection_name:"Host Port Scan"; protection_type:"anomaly"; proto:"4294967295"; s_port:"0"; service:"4294967295"; severity:"1"; smartdefense_profile:"Standard"; source:"Distinct"; src:"192.168.12.1"]

‎packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2335,6 +2335,125 @@
23352335
"user": {
23362336
"name": "test user"
23372337
}
2338+
},
2339+
{
2340+
"@timestamp": "2025-05-06T08:58:25.000Z",
2341+
"checkpoint": {
2342+
"encryption_failure": "no response from peer.",
2343+
"fw_subproduct": "VPN-1",
2344+
"origin_sic_name": "CN=cp_mgmt,O=gw-da58d3..tmn8s8",
2345+
"peer_gateway": "192.168.10.1",
2346+
"reject_category": "IKE failure",
2347+
"rule": "0",
2348+
"scheme": "IKE",
2349+
"vpn_feature_name": "IKE"
2350+
},
2351+
"destination": {
2352+
"ip": "0.0.0.0",
2353+
"port": 0
2354+
},
2355+
"ecs": {
2356+
"version": "8.17.0"
2357+
},
2358+
"event": {
2359+
"action": "Reject",
2360+
"category": [
2361+
"network"
2362+
],
2363+
"id": "{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}",
2364+
"kind": "event",
2365+
"original": "<134>1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 8363 - [action:\"Reject\"; flags:\"44676\"; ifdir:\"inbound\"; ifname:\"daemon\"; loguid:\"{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}\"; origin:\"192.168.0.1\"; originsicname:\"CN=cp_mgmt,O=gw-da58d3..tmn8s8\"; sequencenum:\"22\"; time:\"1746521905\"; version:\"5\"; dst:\"0.0.0.0\"; encryption_failure::\"no response from peer.\"; fw_subproduct:\"VPN-1\"; peer_gateway:\"192.168.10.1\"; proto:\"0\"; reject_category:\"IKE failure\"; rule:\"0\"; s_port:\"0\"; scheme::\"IKE\"; service:\"0\"; src:\"0.0.0.0\"; vpn_feature_name:\"IKE\"]",
2366+
"sequence": 22,
2367+
"timezone": "UTC"
2368+
},
2369+
"network": {
2370+
"direction": "inbound",
2371+
"iana_number": "0",
2372+
"transport": "0"
2373+
},
2374+
"observer": {
2375+
"ingress": {
2376+
"interface": {
2377+
"name": "daemon"
2378+
}
2379+
},
2380+
"name": "192.168.0.1",
2381+
"type": "firewall",
2382+
"vendor": "Checkpoint"
2383+
},
2384+
"related": {
2385+
"ip": [
2386+
"0.0.0.0"
2387+
]
2388+
},
2389+
"source": {
2390+
"ip": "0.0.0.0",
2391+
"port": 0
2392+
},
2393+
"tags": [
2394+
"preserve_original_event"
2395+
]
2396+
},
2397+
{
2398+
"@timestamp": "2025-05-06T00:27:58.000Z",
2399+
"checkpoint": {
2400+
"attack": "Port Scan",
2401+
"attack_info": "Host Port Scan",
2402+
"confidence_level": "5",
2403+
"origin_sic_name": "CN=cp_mgmt,O=gw-da58d3..tmn8s8",
2404+
"performance_impact": "2",
2405+
"protection_id": "HostPortScan",
2406+
"protection_name": "Host Port Scan",
2407+
"protection_type": "anomaly",
2408+
"smartdefense_profile": "Standard",
2409+
"source": "Distinct"
2410+
},
2411+
"destination": {
2412+
"ip": "192.168.10.1"
2413+
},
2414+
"ecs": {
2415+
"version": "8.17.0"
2416+
},
2417+
"event": {
2418+
"action": "Detect",
2419+
"category": [
2420+
"network"
2421+
],
2422+
"id": "{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}",
2423+
"kind": "event",
2424+
"original": "<134>1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 8363 - [action:\"Detect\"; flags:\"44676\"; ifdir:\"inbound\"; ifname:\"eth0\"; loguid:\"{0x5e8148f5,0x0,0x6401a8c0,0x108620ab}\"; origin:\"192.168.0.1\"; originsicname:\"CN=cp_mgmt,O=gw-da58d3..tmn8s8\"; sequencenum:\"22\"; time:\"1746491278\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1746456871;policy_name=Standard\\]\"; attack:\"Port Scan\"; attack_info:\"Host Port Scan\"; confidence_level:\"5\"; dst:\"192.168.10.1\"; performance_impact:\"2\"; product:\"SmartDefense\"; protection_id:\"HostPortScan\"; protection_name:\"Host Port Scan\"; protection_type:\"anomaly\"; proto:\"4294967295\"; s_port:\"0\"; service:\"4294967295\"; severity:\"1\"; smartdefense_profile:\"Standard\"; source:\"Distinct\"; src:\"192.168.12.1\"]",
2425+
"sequence": 22,
2426+
"severity": 1,
2427+
"timezone": "UTC"
2428+
},
2429+
"network": {
2430+
"direction": "inbound",
2431+
"iana_number": "4294967295"
2432+
},
2433+
"observer": {
2434+
"ingress": {
2435+
"interface": {
2436+
"name": "eth0"
2437+
}
2438+
},
2439+
"name": "192.168.0.1",
2440+
"product": "SmartDefense",
2441+
"type": "firewall",
2442+
"vendor": "Checkpoint"
2443+
},
2444+
"related": {
2445+
"ip": [
2446+
"192.168.12.1",
2447+
"192.168.10.1"
2448+
]
2449+
},
2450+
"source": {
2451+
"ip": "192.168.12.1",
2452+
"port": 0
2453+
},
2454+
"tags": [
2455+
"preserve_original_event"
2456+
]
23382457
}
23392458
]
23402459
}

‎packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,7 @@ processors:
285285
type: long
286286
ignore_failure: true
287287
ignore_missing: true
288+
if: "ctx.checkpoint?.service != '4294967295'"
288289
- convert:
289290
field: checkpoint.xlatedport
290291
target_field: destination.nat.port
@@ -799,7 +800,7 @@ processors:
799800
if: ctx?.network?.iana_number != null
800801
source: |
801802
def iana_number = ctx.network.iana_number;
802-
if (iana_number == '0') {
803+
if (iana_number == '0' && ctx.source?.ip?.contains(':')) {
803804
ctx.network.transport = 'hopopt';
804805
} else if (iana_number == '1') {
805806
ctx.network.transport = 'icmp';
@@ -819,8 +820,14 @@ processors:
819820
ctx.network.transport = 'ipv6-icmp';
820821
} else if (iana_number == '112') {
821822
ctx.network.transport = 'vrrp';
823+
} else if (iana_number == '114') {
824+
ctx.network.transport = '0-hop';
822825
} else if (iana_number == '132') {
823826
ctx.network.transport = 'sctp';
827+
} else if (iana_number == '4294967295') {
828+
iana_number = null;
829+
} else {
830+
ctx.network.transport = iana_number;
824831
}
825832
- date:
826833
field: checkpoint.subs_exp

‎packages/checkpoint/data_stream/firewall/fields/fields.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1509,6 +1509,10 @@
15091509
type: keyword
15101510
description: |
15111511
The Check Point session ID.
1512+
- name: source
1513+
type: keyword
1514+
description: |
1515+
Provides additional context for the source of the event.
15121516
- name: source_object
15131517
type: keyword
15141518
description: |

‎packages/checkpoint/docs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -547,6 +547,7 @@ An example event for `firewall` looks as following:
547547
| checkpoint.site_name | Site name. | keyword |
548548
| checkpoint.smartdefense_profile | | keyword |
549549
| checkpoint.snid | The Check Point session ID. | keyword |
550+
| checkpoint.source | Provides additional context for the source of the event. | keyword |
550551
| checkpoint.source_interface | External Interface name for source interface or Null if not found. | keyword |
551552
| checkpoint.source_object | Matched object name on source column. | keyword |
552553
| checkpoint.source_os | OS which generated the attack. | keyword |

‎packages/checkpoint/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: checkpoint
22
title: Check Point
3-
version: "1.39.0"
3+
version: "1.40.0"
44
description: Collect logs from Check Point with Elastic Agent.
55
type: integration
66
format_version: "3.0.3"

0 commit comments

Comments
 (0)