Skip to content

Commit 7d7ddcf

Browse files
efd6efd6
committed
jumpcloud: map jumpcloud.event.changes as flattened
The API docs[1] for the changes field gives it the type "Nested objects" and states that it cannot be searched on, so a flattended matches their semantics. [1]https://docs.jumpcloud.com/api/insights/directory/1.0/index.html#section/Schemas
1 parent a741c45 commit 7d7ddcf

File tree

6 files changed

+87
-29
lines changed

6 files changed

+87
-29
lines changed

‎packages/jumpcloud/_dev/deploy/docker/files/config.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ rules:
1010
Content-Type:
1111
- 'application/json'
1212
body: |
13-
{"@version":"1","client_ip":"81.2.69.144","event_type":"admin_login_attempt","geoip":{"continent_code":"OC","country_code":"AU","latitude":-27.658,"longitude":152.8915,"region_code":"QLD","region_name":"Queensland","timezone":"Australia/Brisbane"},"id":"63c264c6c1bd55c1b7e901a4","initiated_by":{"email":"user.name@sub.domain.tld","id":"123456789abcdef123456789","type":"admin"},"mfa":true,"organization":"1234abcdef123456789abcde","provider":null,"service":"directory","success":true,"timestamp":"2023-01-14T08:16:06.495Z","useragent":{"device":"Mac","major":"109","minor":"0","name":"Chrome","os":"Mac OS X","os_full":"Mac OS X 10.15.7","os_major":"10","os_minor":"15","os_name":"Mac OS X","os_patch":"7","os_version":"10.15.7","patch":"0","version":"109.0.0.0"}}
13+
{"@version":"1","client_ip":"81.2.69.144","event_type":"admin_login_attempt","changes":[{"field":"active","to":true},{"field":"displayName","to":"Willy Wonka"},{"field":"emails","to":[{"primary":true,"type":"work","value":"w.wonka@chocolate.biz"}]},{"field":"externalId","to":"63ec9bba89a64e507ce0a4c2"},{"field":"schemas","to":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]}],"geoip":{"continent_code":"OC","country_code":"AU","latitude":-27.658,"longitude":152.8915,"region_code":"QLD","region_name":"Queensland","timezone":"Australia/Brisbane"},"id":"63c264c6c1bd55c1b7e901a4","initiated_by":{"email":"user.name@sub.domain.tld","id":"123456789abcdef123456789","type":"admin"},"mfa":true,"organization":"1234abcdef123456789abcde","provider":null,"service":"directory","success":true,"timestamp":"2023-01-14T08:16:06.495Z","useragent":{"device":"Mac","major":"109","minor":"0","name":"Chrome","os":"Mac OS X","os_full":"Mac OS X 10.15.7","os_major":"10","os_minor":"15","os_name":"Mac OS X","os_patch":"7","os_version":"10.15.7","patch":"0","version":"109.0.0.0"}}

‎packages/jumpcloud/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.7.1"
3+
changes:
4+
- description: Fix mapping for `jumpcloud.event.changes`.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/8298
27
- version: "1.7.0"
38
changes:
49
- description: Improve 'event.original' check to avoid errors if set.

‎packages/jumpcloud/data_stream/events/fields/fields.yml‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,7 @@
2424
- name: base
2525
type: keyword
2626
- name: changes
27-
type: group
28-
fields:
29-
- name: field
30-
type: keyword
31-
- name: from
32-
type: boolean
33-
- name: to
34-
type: boolean
27+
type: flattened
3528
- name: client_ip
3629
type: keyword
3730
- name: connection_id

‎packages/jumpcloud/data_stream/events/sample_event.json‎

Lines changed: 39 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"@timestamp": "2023-01-14T08:16:06.495Z",
33
"agent": {
4-
"ephemeral_id": "bcbcbf24-2cdd-480e-9b75-96c0bafe1473",
5-
"id": "25caf3f7-6754-40c9-8532-3f029a1a5c4d",
4+
"ephemeral_id": "6bb5080e-3d3c-4b5c-8d62-af0f195b06c8",
5+
"id": "747b3f2a-8b40-4ee3-9ddd-ec86e51f9342",
66
"name": "docker-fleet-agent",
77
"type": "filebeat",
8-
"version": "8.8.2"
8+
"version": "8.10.1"
99
},
1010
"client": {
1111
"geo": {
@@ -31,22 +31,22 @@
3131
"version": "8.10.0"
3232
},
3333
"elastic_agent": {
34-
"id": "25caf3f7-6754-40c9-8532-3f029a1a5c4d",
34+
"id": "747b3f2a-8b40-4ee3-9ddd-ec86e51f9342",
3535
"snapshot": false,
36-
"version": "8.8.2"
36+
"version": "8.10.1"
3737
},
3838
"event": {
3939
"action": "admin_login_attempt",
4040
"agent_id_status": "verified",
4141
"category": [
4242
"authentication"
4343
],
44-
"created": "2023-08-01T09:12:24.427Z",
44+
"created": "2023-10-26T06:57:29.823Z",
4545
"dataset": "jumpcloud.events",
4646
"id": "63c264c6c1bd55c1b7e901a4",
47-
"ingested": "2023-08-01T09:12:25Z",
47+
"ingested": "2023-10-26T06:57:32Z",
4848
"module": "directory",
49-
"original": "{\"@version\":\"1\",\"client_ip\":\"81.2.69.144\",\"event_type\":\"admin_login_attempt\",\"geoip\":{\"continent_code\":\"OC\",\"country_code\":\"AU\",\"latitude\":-27.658,\"longitude\":152.8915,\"region_code\":\"QLD\",\"region_name\":\"Queensland\",\"timezone\":\"Australia/Brisbane\"},\"id\":\"63c264c6c1bd55c1b7e901a4\",\"initiated_by\":{\"email\":\"user.name@sub.domain.tld\",\"id\":\"123456789abcdef123456789\",\"type\":\"admin\"},\"mfa\":true,\"organization\":\"1234abcdef123456789abcde\",\"provider\":null,\"service\":\"directory\",\"success\":true,\"timestamp\":\"2023-01-14T08:16:06.495Z\",\"useragent\":{\"device\":\"Mac\",\"major\":\"109\",\"minor\":\"0\",\"name\":\"Chrome\",\"os\":\"Mac OS X\",\"os_full\":\"Mac OS X 10.15.7\",\"os_major\":\"10\",\"os_minor\":\"15\",\"os_name\":\"Mac OS X\",\"os_patch\":\"7\",\"os_version\":\"10.15.7\",\"patch\":\"0\",\"version\":\"109.0.0.0\"}}",
49+
"original": "{\"@version\":\"1\",\"changes\":[{\"field\":\"active\",\"to\":true},{\"field\":\"displayName\",\"to\":\"Willy Wonka\"},{\"field\":\"emails\",\"to\":[{\"primary\":true,\"type\":\"work\",\"value\":\"w.wonka@chocolate.biz\"}]},{\"field\":\"externalId\",\"to\":\"63ec9bba89a64e507ce0a4c2\"},{\"field\":\"schemas\",\"to\":[\"urn:ietf:params:scim:schemas:core:2.0:User\",\"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User\"]}],\"client_ip\":\"81.2.69.144\",\"event_type\":\"admin_login_attempt\",\"geoip\":{\"continent_code\":\"OC\",\"country_code\":\"AU\",\"latitude\":-27.658,\"longitude\":152.8915,\"region_code\":\"QLD\",\"region_name\":\"Queensland\",\"timezone\":\"Australia/Brisbane\"},\"id\":\"63c264c6c1bd55c1b7e901a4\",\"initiated_by\":{\"email\":\"user.name@sub.domain.tld\",\"id\":\"123456789abcdef123456789\",\"type\":\"admin\"},\"mfa\":true,\"organization\":\"1234abcdef123456789abcde\",\"provider\":null,\"service\":\"directory\",\"success\":true,\"timestamp\":\"2023-01-14T08:16:06.495Z\",\"useragent\":{\"device\":\"Mac\",\"major\":\"109\",\"minor\":\"0\",\"name\":\"Chrome\",\"os\":\"Mac OS X\",\"os_full\":\"Mac OS X 10.15.7\",\"os_major\":\"10\",\"os_minor\":\"15\",\"os_name\":\"Mac OS X\",\"os_patch\":\"7\",\"os_version\":\"10.15.7\",\"patch\":\"0\",\"version\":\"109.0.0.0\"}}",
5050
"outcome": "success",
5151
"type": [
5252
"info"
@@ -57,6 +57,37 @@
5757
},
5858
"jumpcloud": {
5959
"event": {
60+
"changes": [
61+
{
62+
"field": "active",
63+
"to": true
64+
},
65+
{
66+
"field": "displayName",
67+
"to": "Willy Wonka"
68+
},
69+
{
70+
"field": "emails",
71+
"to": [
72+
{
73+
"primary": true,
74+
"type": "work",
75+
"value": "w.wonka@chocolate.biz"
76+
}
77+
]
78+
},
79+
{
80+
"field": "externalId",
81+
"to": "63ec9bba89a64e507ce0a4c2"
82+
},
83+
{
84+
"field": "schemas",
85+
"to": [
86+
"urn:ietf:params:scim:schemas:core:2.0:User",
87+
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
88+
]
89+
}
90+
],
6091
"client_ip": "81.2.69.144",
6192
"event_type": "admin_login_attempt",
6293
"geoip": {

‎packages/jumpcloud/docs/README.md‎

Lines changed: 40 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -117,9 +117,7 @@ All JumpCloud Directory Insights events are available in the `jumpcloud.events`
117117
| jumpcloud.event.auth_meta.auth_methods.password.success | | boolean |
118118
| jumpcloud.event.auth_method | | keyword |
119119
| jumpcloud.event.base | | keyword |
120-
| jumpcloud.event.changes.field | | keyword |
121-
| jumpcloud.event.changes.from | | boolean |
122-
| jumpcloud.event.changes.to | | boolean |
120+
| jumpcloud.event.changes | | flattened |
123121
| jumpcloud.event.client_ip | | keyword |
124122
| jumpcloud.event.connection_id | | keyword |
125123
| jumpcloud.event.deref | | long |
@@ -235,11 +233,11 @@ An example event for `events` looks as following:
235233
{
236234
"@timestamp": "2023-01-14T08:16:06.495Z",
237235
"agent": {
238-
"ephemeral_id": "bcbcbf24-2cdd-480e-9b75-96c0bafe1473",
239-
"id": "25caf3f7-6754-40c9-8532-3f029a1a5c4d",
236+
"ephemeral_id": "6bb5080e-3d3c-4b5c-8d62-af0f195b06c8",
237+
"id": "747b3f2a-8b40-4ee3-9ddd-ec86e51f9342",
240238
"name": "docker-fleet-agent",
241239
"type": "filebeat",
242-
"version": "8.8.2"
240+
"version": "8.10.1"
243241
},
244242
"client": {
245243
"geo": {
@@ -265,22 +263,22 @@ An example event for `events` looks as following:
265263
"version": "8.10.0"
266264
},
267265
"elastic_agent": {
268-
"id": "25caf3f7-6754-40c9-8532-3f029a1a5c4d",
266+
"id": "747b3f2a-8b40-4ee3-9ddd-ec86e51f9342",
269267
"snapshot": false,
270-
"version": "8.8.2"
268+
"version": "8.10.1"
271269
},
272270
"event": {
273271
"action": "admin_login_attempt",
274272
"agent_id_status": "verified",
275273
"category": [
276274
"authentication"
277275
],
278-
"created": "2023-08-01T09:12:24.427Z",
276+
"created": "2023-10-26T06:57:29.823Z",
279277
"dataset": "jumpcloud.events",
280278
"id": "63c264c6c1bd55c1b7e901a4",
281-
"ingested": "2023-08-01T09:12:25Z",
279+
"ingested": "2023-10-26T06:57:32Z",
282280
"module": "directory",
283-
"original": "{\"@version\":\"1\",\"client_ip\":\"81.2.69.144\",\"event_type\":\"admin_login_attempt\",\"geoip\":{\"continent_code\":\"OC\",\"country_code\":\"AU\",\"latitude\":-27.658,\"longitude\":152.8915,\"region_code\":\"QLD\",\"region_name\":\"Queensland\",\"timezone\":\"Australia/Brisbane\"},\"id\":\"63c264c6c1bd55c1b7e901a4\",\"initiated_by\":{\"email\":\"user.name@sub.domain.tld\",\"id\":\"123456789abcdef123456789\",\"type\":\"admin\"},\"mfa\":true,\"organization\":\"1234abcdef123456789abcde\",\"provider\":null,\"service\":\"directory\",\"success\":true,\"timestamp\":\"2023-01-14T08:16:06.495Z\",\"useragent\":{\"device\":\"Mac\",\"major\":\"109\",\"minor\":\"0\",\"name\":\"Chrome\",\"os\":\"Mac OS X\",\"os_full\":\"Mac OS X 10.15.7\",\"os_major\":\"10\",\"os_minor\":\"15\",\"os_name\":\"Mac OS X\",\"os_patch\":\"7\",\"os_version\":\"10.15.7\",\"patch\":\"0\",\"version\":\"109.0.0.0\"}}",
281+
"original": "{\"@version\":\"1\",\"changes\":[{\"field\":\"active\",\"to\":true},{\"field\":\"displayName\",\"to\":\"Willy Wonka\"},{\"field\":\"emails\",\"to\":[{\"primary\":true,\"type\":\"work\",\"value\":\"w.wonka@chocolate.biz\"}]},{\"field\":\"externalId\",\"to\":\"63ec9bba89a64e507ce0a4c2\"},{\"field\":\"schemas\",\"to\":[\"urn:ietf:params:scim:schemas:core:2.0:User\",\"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User\"]}],\"client_ip\":\"81.2.69.144\",\"event_type\":\"admin_login_attempt\",\"geoip\":{\"continent_code\":\"OC\",\"country_code\":\"AU\",\"latitude\":-27.658,\"longitude\":152.8915,\"region_code\":\"QLD\",\"region_name\":\"Queensland\",\"timezone\":\"Australia/Brisbane\"},\"id\":\"63c264c6c1bd55c1b7e901a4\",\"initiated_by\":{\"email\":\"user.name@sub.domain.tld\",\"id\":\"123456789abcdef123456789\",\"type\":\"admin\"},\"mfa\":true,\"organization\":\"1234abcdef123456789abcde\",\"provider\":null,\"service\":\"directory\",\"success\":true,\"timestamp\":\"2023-01-14T08:16:06.495Z\",\"useragent\":{\"device\":\"Mac\",\"major\":\"109\",\"minor\":\"0\",\"name\":\"Chrome\",\"os\":\"Mac OS X\",\"os_full\":\"Mac OS X 10.15.7\",\"os_major\":\"10\",\"os_minor\":\"15\",\"os_name\":\"Mac OS X\",\"os_patch\":\"7\",\"os_version\":\"10.15.7\",\"patch\":\"0\",\"version\":\"109.0.0.0\"}}",
284282
"outcome": "success",
285283
"type": [
286284
"info"
@@ -291,6 +289,37 @@ An example event for `events` looks as following:
291289
},
292290
"jumpcloud": {
293291
"event": {
292+
"changes": [
293+
{
294+
"field": "active",
295+
"to": true
296+
},
297+
{
298+
"field": "displayName",
299+
"to": "Willy Wonka"
300+
},
301+
{
302+
"field": "emails",
303+
"to": [
304+
{
305+
"primary": true,
306+
"type": "work",
307+
"value": "w.wonka@chocolate.biz"
308+
}
309+
]
310+
},
311+
{
312+
"field": "externalId",
313+
"to": "63ec9bba89a64e507ce0a4c2"
314+
},
315+
{
316+
"field": "schemas",
317+
"to": [
318+
"urn:ietf:params:scim:schemas:core:2.0:User",
319+
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
320+
]
321+
}
322+
],
294323
"client_ip": "81.2.69.144",
295324
"event_type": "admin_login_attempt",
296325
"geoip": {

‎packages/jumpcloud/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.0"
22
name: jumpcloud
33
title: "JumpCloud"
4-
version: "1.7.0"
4+
version: "1.7.1"
55
description: "Collect logs from JumpCloud Directory as a Service"
66
type: integration
77
categories:

0 commit comments

Comments
 (0)