Skip to content

Commit 753522b

Browse files
stefans-elasticstefans-elastic
authored
Merge branch 'main' into kafka-docs-update
2 parents 13882cc + 95b2cbc commit 753522b

File tree

25 files changed

+1171
-36
lines changed

25 files changed

+1171
-36
lines changed

‎packages/citrix_adc/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.17.2"
3+
changes:
4+
- description: "Fix grok processing for HTTPREQUEST and UDPFLOWSTAT in sslvpn_and_aaatm_feature pipeline with optional patterns."
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15378
27
- version: "1.17.1"
38
changes:
49
- description: "Fix Grok processing for LOGOUT and HTTPREQUEST event types in sslvpn_and_aaatm_feature pipeline."

‎packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native-14-1.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<134> 11/18/2024:11:11:00 GMT DCLVNSGP001 0-PPE-1 : default SSLVPN HTTPREQUEST 12345678 0 : [TECHSUPPORT][ENUMERATION] some.url.com User some@url.com : Group(s) N/A : Vserver 0.0.0.0:300 - 09/04/2025:18:24:45 GMT : Message = SSO is OFF : GET /path/path.xml - -
2+
<134> 09/04/2025:18:24:36 GMT DCLVNSGP001 0-PPE-6 : default SSLVPN UDPFLOWSTAT 58680561 0 : [TECHSUPPORT] User username.example.com - Client_ip 175.16.199.1 - Nat_ip 89.160.20.129 - Vserver 67.43.156.1:443 - Source 81.2.69.194:63685 - Destination 1.128.0.1:53 - Start_time "09/09/2024:20:44:03 GMT" - End_time "09/09/2024:20:46:06 GMT" - Duration 00:05:53 - Total_bytes_send 656 - Total_bytes_recv 2456 - Access Allowed - Group(s) "N/A"

‎packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native-14-1.log-expected.json‎

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2024-11-18T11:11:00.000Z",
5+
"citrix": {
6+
"cef_format": false,
7+
"default_class": true,
8+
"detail": "<134> 11/18/2024:11:11:00 GMT DCLVNSGP001 0-PPE-1 : default SSLVPN HTTPREQUEST 12345678 0 : [TECHSUPPORT][ENUMERATION] some.url.com User some@url.com : Group(s) N/A : Vserver 0.0.0.0:300 - 09/04/2025:18:24:45 GMT : Message = SSO is OFF : GET /path/path.xml - -",
9+
"device_event_class_id": "SSLVPN",
10+
"extended": {
11+
"message": "[TECHSUPPORT][ENUMERATION] some.url.com User some@url.com : Group(s) N/A : Vserver 0.0.0.0:300 - 09/04/2025:18:24:45 GMT : Message = SSO is OFF : GET /path/path.xml - -"
12+
},
13+
"host": "DCLVNSGP001",
14+
"name": "HTTPREQUEST"
15+
},
16+
"citrix_adc": {
17+
"log": {
18+
"groups": "N/A",
19+
"hostname": "some.url.com",
20+
"message": "[TECHSUPPORT][ENUMERATION] some.url.com User some@url.com : Group(s) N/A : Vserver 0.0.0.0:300 - 09/04/2025:18:24:45 GMT : Message = SSO is OFF : GET /path/path.xml - -",
21+
"method": "GET",
22+
"request": {
23+
"path": "/path/path.xml"
24+
},
25+
"sso_status": "OFF",
26+
"timestamp": "2025-09-04T18:24:45.000Z",
27+
"timezone": "GMT",
28+
"user": "some@url.com",
29+
"vserver": {
30+
"ip": "0.0.0.0",
31+
"port": 300
32+
}
33+
}
34+
},
35+
"ecs": {
36+
"version": "8.11.0"
37+
},
38+
"event": {
39+
"category": [
40+
"authentication"
41+
],
42+
"id": "12345678",
43+
"kind": "event",
44+
"original": "<134> 11/18/2024:11:11:00 GMT DCLVNSGP001 0-PPE-1 : default SSLVPN HTTPREQUEST 12345678 0 : [TECHSUPPORT][ENUMERATION] some.url.com User some@url.com : Group(s) N/A : Vserver 0.0.0.0:300 - 09/04/2025:18:24:45 GMT : Message = SSO is OFF : GET /path/path.xml - -",
45+
"severity": 0,
46+
"timezone": "GMT",
47+
"type": [
48+
"info"
49+
]
50+
},
51+
"group": {
52+
"name": "N/A"
53+
},
54+
"observer": {
55+
"hostname": "DCLVNSGP001",
56+
"product": "Netscaler",
57+
"type": "firewall",
58+
"vendor": "Citrix"
59+
},
60+
"related": {
61+
"ip": [
62+
"0.0.0.0"
63+
],
64+
"user": [
65+
"some",
66+
"some@url.com"
67+
]
68+
},
69+
"server": {
70+
"ip": "0.0.0.0",
71+
"port": 300
72+
},
73+
"tags": [
74+
"preserve_original_event",
75+
"preserve_duplicate_custom_fields"
76+
],
77+
"url": {
78+
"domain": "some.url.com"
79+
},
80+
"user": {
81+
"domain": "url.com",
82+
"email": "some@url.com",
83+
"name": "some"
84+
}
85+
},
86+
{
87+
"@timestamp": "2025-09-04T18:24:36.000Z",
88+
"citrix": {
89+
"cef_format": false,
90+
"default_class": true,
91+
"detail": "<134> 09/04/2025:18:24:36 GMT DCLVNSGP001 0-PPE-6 : default SSLVPN UDPFLOWSTAT 58680561 0 : [TECHSUPPORT] User username.example.com - Client_ip 175.16.199.1 - Nat_ip 89.160.20.129 - Vserver 67.43.156.1:443 - Source 81.2.69.194:63685 - Destination 1.128.0.1:53 - Start_time \"09/09/2024:20:44:03 GMT\" - End_time \"09/09/2024:20:46:06 GMT\" - Duration 00:05:53 - Total_bytes_send 656 - Total_bytes_recv 2456 - Access Allowed - Group(s) \"N/A\"",
92+
"device_event_class_id": "SSLVPN",
93+
"extended": {
94+
"message": "[TECHSUPPORT] User username.example.com - Client_ip 175.16.199.1 - Nat_ip 89.160.20.129 - Vserver 67.43.156.1:443 - Source 81.2.69.194:63685 - Destination 1.128.0.1:53 - Start_time \"09/09/2024:20:44:03 GMT\" - End_time \"09/09/2024:20:46:06 GMT\" - Duration 00:05:53 - Total_bytes_send 656 - Total_bytes_recv 2456 - Access Allowed - Group(s) \"N/A\""
95+
},
96+
"host": "DCLVNSGP001",
97+
"name": "UDPFLOWSTAT"
98+
},
99+
"citrix_adc": {
100+
"log": {
101+
"access": "Allowed",
102+
"client_ip": "175.16.199.1",
103+
"destination": {
104+
"ip": "1.128.0.1",
105+
"port": 53
106+
},
107+
"duration": "00:05:53 ",
108+
"end_time": "2024-09-09T20:46:06.000Z",
109+
"groups": "N/A",
110+
"message": "[TECHSUPPORT] User username.example.com - Client_ip 175.16.199.1 - Nat_ip 89.160.20.129 - Vserver 67.43.156.1:443 - Source 81.2.69.194:63685 - Destination 1.128.0.1:53 - Start_time \"09/09/2024:20:44:03 GMT\" - End_time \"09/09/2024:20:46:06 GMT\" - Duration 00:05:53 - Total_bytes_send 656 - Total_bytes_recv 2456 - Access Allowed - Group(s) \"N/A\"",
111+
"nat": {
112+
"ip": "89.160.20.129"
113+
},
114+
"source": {
115+
"ip": "81.2.69.194",
116+
"port": 63685
117+
},
118+
"start_time": "2024-09-09T20:44:03.000Z",
119+
"total_bytes_received": 2456,
120+
"total_bytes_send": 656,
121+
"user": "username.example.com",
122+
"vserver": {
123+
"ip": "67.43.156.1",
124+
"port": 443
125+
}
126+
}
127+
},
128+
"client": {
129+
"geo": {
130+
"city_name": "Changchun",
131+
"continent_name": "Asia",
132+
"country_iso_code": "CN",
133+
"country_name": "China",
134+
"location": {
135+
"lat": 43.88,
136+
"lon": 125.3228
137+
},
138+
"region_iso_code": "CN-22",
139+
"region_name": "Jilin Sheng"
140+
},
141+
"ip": "175.16.199.1"
142+
},
143+
"destination": {
144+
"bytes": 2456,
145+
"ip": "1.128.0.1",
146+
"port": 53
147+
},
148+
"ecs": {
149+
"version": "8.11.0"
150+
},
151+
"event": {
152+
"category": [
153+
"authentication"
154+
],
155+
"duration": 123000000000,
156+
"end": "2024-09-09T20:46:06.000Z",
157+
"id": "58680561",
158+
"kind": "event",
159+
"original": "<134> 09/04/2025:18:24:36 GMT DCLVNSGP001 0-PPE-6 : default SSLVPN UDPFLOWSTAT 58680561 0 : [TECHSUPPORT] User username.example.com - Client_ip 175.16.199.1 - Nat_ip 89.160.20.129 - Vserver 67.43.156.1:443 - Source 81.2.69.194:63685 - Destination 1.128.0.1:53 - Start_time \"09/09/2024:20:44:03 GMT\" - End_time \"09/09/2024:20:46:06 GMT\" - Duration 00:05:53 - Total_bytes_send 656 - Total_bytes_recv 2456 - Access Allowed - Group(s) \"N/A\"",
160+
"severity": 0,
161+
"start": "2024-09-09T20:44:03.000Z",
162+
"timezone": "GMT",
163+
"type": [
164+
"info"
165+
]
166+
},
167+
"group": {
168+
"name": "N/A"
169+
},
170+
"observer": {
171+
"hostname": "DCLVNSGP001",
172+
"product": "Netscaler",
173+
"type": "firewall",
174+
"vendor": "Citrix"
175+
},
176+
"related": {
177+
"ip": [
178+
"81.2.69.194",
179+
"1.128.0.1",
180+
"89.160.20.129",
181+
"67.43.156.1",
182+
"175.16.199.1"
183+
],
184+
"user": [
185+
"username.example.com"
186+
]
187+
},
188+
"server": {
189+
"ip": "67.43.156.1",
190+
"port": 443
191+
},
192+
"source": {
193+
"bytes": 656,
194+
"geo": {
195+
"city_name": "London",
196+
"continent_name": "Europe",
197+
"country_iso_code": "GB",
198+
"country_name": "United Kingdom",
199+
"location": {
200+
"lat": 51.5142,
201+
"lon": -0.0931
202+
},
203+
"region_iso_code": "GB-ENG",
204+
"region_name": "England"
205+
},
206+
"ip": "81.2.69.194",
207+
"nat": {
208+
"ip": "89.160.20.129"
209+
},
210+
"port": 63685
211+
},
212+
"tags": [
213+
"preserve_original_event",
214+
"preserve_duplicate_custom_fields"
215+
],
216+
"user": {
217+
"name": "username.example.com"
218+
}
219+
}
220+
]
221+
}

‎packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8963,11 +8963,12 @@
89638963
"groups": "N/A",
89648964
"hostname": "citrix.example.com",
89658965
"message": "Context user.name@81.2.69.145 - SessionId: 1756710 - [TECHSUPPORT][ENUMERATION] citrix.example.com User user.name : Group(s) N/A : Vserver 81.2.69.143:443 - 07/12/2024:06:54:39 GMT : Message = SSO is OFF : POST /TEST/.test - -",
8966-
"method": "Message",
8966+
"method": "POST",
89678967
"request": {
8968-
"path": "= SSO is OFF : POST /TEST/.test"
8968+
"path": "/TEST/.test"
89698969
},
89708970
"session_id": "1756710",
8971+
"sso_status": "OFF",
89718972
"timestamp": "2024-07-12T06:54:39.000Z",
89728973
"timezone": "GMT",
89738974
"user": "user.name",

‎packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/sslvpn_and_aaatm_feature.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ processors:
7575
field: citrix.extended.message
7676
patterns:
7777
- '^User %{DATA:citrix_adc.log.user} - Client_ip %{IP:citrix_adc.log.client_ip} - Nat_ip (%{IP:citrix_adc.log.nat.ip}|"${DATA}") - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - Start_time "%{DATA:_tmp.start_time}" - End_time "%{GREEDYDATA:_tmp.end_time}" - Duration %{DATA:citrix_adc.log.duration} - Total_bytes_send %{NUMBER:citrix_adc.log.total_bytes_send:int} - Total_bytes_recv %{NUMBER:citrix_adc.log.total_bytes_received:int} - Access %{WORD:citrix_adc.log.access} - Group\(s\) "%{DATA:citrix_adc.log.groups}" ?$'
78-
- '^Context %{DATA:citrix_adc.log.username}@%{IP} - SessionId: %{NUMBER:citrix_adc.log.session_id} - \[%{DATA}\] User %{DATA:citrix_adc.log.user} - Client_ip %{IP:citrix_adc.log.client_ip} - Nat_ip (%{IP:citrix_adc.log.nat.ip}|"${DATA}") - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - Start_time "%{DATA:_tmp.start_time}" - End_time "%{GREEDYDATA:_tmp.end_time}" - Duration %{DATA:citrix_adc.log.duration} - Total_bytes_send %{NUMBER:citrix_adc.log.total_bytes_send:int} - Total_bytes_recv %{NUMBER:citrix_adc.log.total_bytes_received:int} - Access %{WORD:citrix_adc.log.access} - Group\(s\) "%{DATA:citrix_adc.log.groups}" ?$'
78+
- '^(Context %{DATA:citrix_adc.log.username}@%{IP} - SessionId: %{NUMBER:citrix_adc.log.session_id} - )?(\[%{DATA}\] )?User %{DATA:citrix_adc.log.user} - Client_ip %{IP:citrix_adc.log.client_ip} - Nat_ip (%{IP:citrix_adc.log.nat.ip}|"${DATA}") - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - Start_time "%{DATA:_tmp.start_time}" - End_time "%{GREEDYDATA:_tmp.end_time}" - Duration %{DATA:citrix_adc.log.duration} - Total_bytes_send %{NUMBER:citrix_adc.log.total_bytes_send:int} - Total_bytes_recv %{NUMBER:citrix_adc.log.total_bytes_received:int} - Access %{WORD:citrix_adc.log.access} - Group\(s\) "%{DATA:citrix_adc.log.groups}" ?$'
7979

8080
- grok:
8181
tag: grok_sslvpn_httprequest
@@ -91,7 +91,7 @@ processors:
9191
REQUEST_INFO: "%{WORD:citrix_adc.log.method} %{DATA:citrix_adc.log.request.path} - -"
9292
TIMESTAMP_TZ: "%{DATA:_tmp.timestamp} %{DATA:citrix_adc.log.timezone}"
9393
patterns:
94-
- '^%{CONTEXT_INFO} %{TECH_SUPPORT}%{HOST_USER_GROUP} : %{VSERVER_INFO} - %{DATA:_tmp.timestamp}(?: %{WORD:citrix_adc.log.timezone})?(?: : SSO is %{WORD:citrix_adc.log.sso_status})? : %{REQUEST_INFO} ?$'
94+
- '^(?:%{CONTEXT_INFO} )?%{TECH_SUPPORT}%{HOST_USER_GROUP} : %{VSERVER_INFO} - %{DATA:_tmp.timestamp}(?: %{WORD:citrix_adc.log.timezone})?(?: : (?:Message = )?SSO is %{WORD:citrix_adc.log.sso_status})? : %{REQUEST_INFO} ?$'
9595
- '^%{CONTEXT_INFO} %{TECH_SUPPORT}%{HOST_USER_GROUP} : %{VSERVER_INFO} - %{TIMESTAMP_TZ} %{REQUEST_INFO} ?$'
9696

9797
- grok:

‎packages/citrix_adc/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.2"
22
name: citrix_adc
33
title: Citrix ADC
4-
version: "1.17.1"
4+
version: "1.17.2"
55
description: This Elastic integration collects logs and metrics from Citrix ADC product.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)