Skip to content

Commit 86f99e3

Browse files
niraj-crestniraj-crest
authored
Merge branch 'main' into ti_google_threat_intelligence_phase_1
2 parents 966ed3e + e836ea2 commit 86f99e3

File tree

12 files changed

+191
-93
lines changed

12 files changed

+191
-93
lines changed

‎packages/aws/_dev/build/docs/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ There are a few ways to provide AWS credentials:
9191
* Use temporary security credentials
9292
* Use a shared credentials file
9393
* Use an IAM role Amazon Resource Name (ARN)
94+
* Use an EC2 instance's IAM Role
9495

9596
#### Use access keys directly
9697

@@ -163,6 +164,19 @@ Note: If `role_arn` is given, the package will check if access keys are given.
163164
If they are not given, the package will check for a credential profile name.
164165
If neither is given, the default credential profile will be used.
165166

167+
#### Use an EC2 instance's IAM Role
168+
169+
When Elastic Agent runs on an EC2 instance that has an IAM role attached via an instance profile, it can automatically authenticate to AWS services using a temporary access key pair and session token provided by the Instance Metadata Service (IMDS). For more details see [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html).
170+
171+
To use the IAM role attached to the EC2 instance, leave all of the following options empty:
172+
173+
* `access_key_id`
174+
* `secret_access_key`
175+
* `session_token`
176+
* `credential_profile_name`
177+
* `shared_credential_file`
178+
* `role_arn`
179+
166180
### AWS Permissions
167181

168182
Specific AWS permissions are required for the IAM user to make specific AWS API calls.

‎packages/aws/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.3.2"
3+
changes:
4+
- description: Update README - EC2 Instance IAM Role for AWS Authentication
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13434
27
- version: "3.3.1"
38
changes:
49
- description: Fix handling of duplicate fields in Network Firewall Logs data stream.

‎packages/aws/docs/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ There are a few ways to provide AWS credentials:
9191
* Use temporary security credentials
9292
* Use a shared credentials file
9393
* Use an IAM role Amazon Resource Name (ARN)
94+
* Use an EC2 instance's IAM Role
9495

9596
#### Use access keys directly
9697

@@ -163,6 +164,19 @@ Note: If `role_arn` is given, the package will check if access keys are given.
163164
If they are not given, the package will check for a credential profile name.
164165
If neither is given, the default credential profile will be used.
165166

167+
#### Use an EC2 instance's IAM Role
168+
169+
When Elastic Agent runs on an EC2 instance that has an IAM role attached via an instance profile, it can automatically authenticate to AWS services using a temporary access key pair and session token provided by the Instance Metadata Service (IMDS). For more details see [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html).
170+
171+
To use the IAM role attached to the EC2 instance, leave all of the following options empty:
172+
173+
* `access_key_id`
174+
* `secret_access_key`
175+
* `session_token`
176+
* `credential_profile_name`
177+
* `shared_credential_file`
178+
* `role_arn`
179+
166180
### AWS Permissions
167181

168182
Specific AWS permissions are required for the IAM user to make specific AWS API calls.

‎packages/aws/manifest.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
format_version: 3.3.1
1+
format_version: 3.3.2
22
name: aws
33
title: AWS
4-
version: 3.3.1
4+
version: 3.3.2
55
description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
66
type: integration
77
categories:

‎packages/azure/_dev/build/docs/events.md‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -71,18 +71,18 @@ The integration routes the logs to the most appropriate data stream based on the
7171

7272
Use the following table to identify the target data streams for each log category. For example, if the integration receives a log event with the `NonInteractiveUserSignInLogs` category, it will infer `azure.signinlogs` as dataset, indexing the log into `logs-azure.signinlogs-default` data stream.
7373

74-
| Data Stream | Log Category |
75-
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
76-
| `logs-azure.activitylogs-*` | Administrative, Security, ServiceHealth, Alert, Recommendation, Policy, Autoscale, ResourceHealth |
77-
| `logs-azure.application_gateway-*` | ApplicationGatewayFirewallLog, ApplicationGatewayAccessLog |
78-
| `logs-azure.auditlogs-*` | AuditLogs |
79-
| `logs-azure.firewall_logs-*` | AzureFirewallApplicationRule, AzureFirewallNetworkRule, AzureFirewallDnsProxy, AZFWApplicationRule, AZFWNetworkRule, AZFWNatRule, AZFWDnsQuery |
80-
| `logs-azure.graphactivitylog-*` | MicrosoftGraphActivityLogs |
81-
| `logs-azure.identity_protection-*` | RiskyUsers, UserRiskEvents |
82-
| `logs-azure.provisioning-*` | ProvisioningLogs |
83-
| `logs-azure.signinlogs-*` | SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs |
84-
| `logs-azure.springcloudlogs-*` | ApplicationConsole, SystemLogs, IngressLogs, BuildLogs, ContainerEventLogs |
85-
| `logs-azure.platformlogs-*` | All other log categories |
74+
| Data Stream | Log Categories |
75+
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
76+
| `logs-azure.activitylogs-*` | `Administrative`, `Security`, `ServiceHealth`, `Alert`, `Recommendation`, `Policy`, `Autoscale`, `ResourceHealth` |
77+
| `logs-azure.application_gateway-*` | `ApplicationGatewayFirewallLog`, `ApplicationGatewayAccessLog` |
78+
| `logs-azure.auditlogs-*` | `AuditLogs` |
79+
| `logs-azure.firewall_logs-*` | `AzureFirewallApplicationRule`, `AzureFirewallNetworkRule`, `AzureFirewallDnsProxy`, `AZFWApplicationRule`, `AZFWNetworkRule`, `AZFWNatRule`, `AZFWDnsQuery` |
80+
| `logs-azure.graphactivitylog-*` | `MicrosoftGraphActivityLogs` |
81+
| `logs-azure.identity_protection-*` | `RiskyUsers`, `UserRiskEvents` |
82+
| `logs-azure.provisioning-*` | `ProvisioningLogs` |
83+
| `logs-azure.signinlogs-*` | `SignInLogs`, `NonInteractiveUserSignInLogs`, `ServicePrincipalSignInLogs`, `ManagedIdentitySignInLogs` |
84+
| `logs-azure.springcloudlogs-*` | `ApplicationConsole`, `SystemLogs`, `IngressLogs`, `BuildLogs`, `ContainerEventLogs` |
85+
| `logs-azure.platformlogs-*` | All other log categories |
8686

8787
### What about all other log categories?
8888

‎packages/azure/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
- version: "1.23.3"
2+
changes:
3+
- description: Improve Azure logs documentation with more details on log categories routing rules.
4+
type: enhancement
5+
link: https://github.com/elastic/integrations/pull/13863
16
- version: "1.23.2"
27
changes:
38
- description: Fix Grok processor error in ingest pipeline for `AzureFirewallNetworkRuleLog` in `azure.firewall_logs`.

‎packages/azure/docs/events.md‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -71,18 +71,18 @@ The integration routes the logs to the most appropriate data stream based on the
7171

7272
Use the following table to identify the target data streams for each log category. For example, if the integration receives a log event with the `NonInteractiveUserSignInLogs` category, it will infer `azure.signinlogs` as dataset, indexing the log into `logs-azure.signinlogs-default` data stream.
7373

74-
| Data Stream | Log Category |
75-
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
76-
| `logs-azure.activitylogs-*` | Administrative, Security, ServiceHealth, Alert, Recommendation, Policy, Autoscale, ResourceHealth |
77-
| `logs-azure.application_gateway-*` | ApplicationGatewayFirewallLog, ApplicationGatewayAccessLog |
78-
| `logs-azure.auditlogs-*` | AuditLogs |
79-
| `logs-azure.firewall_logs-*` | AzureFirewallApplicationRule, AzureFirewallNetworkRule, AzureFirewallDnsProxy, AZFWApplicationRule, AZFWNetworkRule, AZFWNatRule, AZFWDnsQuery |
80-
| `logs-azure.graphactivitylog-*` | MicrosoftGraphActivityLogs |
81-
| `logs-azure.identity_protection-*` | RiskyUsers, UserRiskEvents |
82-
| `logs-azure.provisioning-*` | ProvisioningLogs |
83-
| `logs-azure.signinlogs-*` | SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs |
84-
| `logs-azure.springcloudlogs-*` | ApplicationConsole, SystemLogs, IngressLogs, BuildLogs, ContainerEventLogs |
85-
| `logs-azure.platformlogs-*` | All other log categories |
74+
| Data Stream | Log Categories |
75+
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
76+
| `logs-azure.activitylogs-*` | `Administrative`, `Security`, `ServiceHealth`, `Alert`, `Recommendation`, `Policy`, `Autoscale`, `ResourceHealth` |
77+
| `logs-azure.application_gateway-*` | `ApplicationGatewayFirewallLog`, `ApplicationGatewayAccessLog` |
78+
| `logs-azure.auditlogs-*` | `AuditLogs` |
79+
| `logs-azure.firewall_logs-*` | `AzureFirewallApplicationRule`, `AzureFirewallNetworkRule`, `AzureFirewallDnsProxy`, `AZFWApplicationRule`, `AZFWNetworkRule`, `AZFWNatRule`, `AZFWDnsQuery` |
80+
| `logs-azure.graphactivitylog-*` | `MicrosoftGraphActivityLogs` |
81+
| `logs-azure.identity_protection-*` | `RiskyUsers`, `UserRiskEvents` |
82+
| `logs-azure.provisioning-*` | `ProvisioningLogs` |
83+
| `logs-azure.signinlogs-*` | `SignInLogs`, `NonInteractiveUserSignInLogs`, `ServicePrincipalSignInLogs`, `ManagedIdentitySignInLogs` |
84+
| `logs-azure.springcloudlogs-*` | `ApplicationConsole`, `SystemLogs`, `IngressLogs`, `BuildLogs`, `ContainerEventLogs` |
85+
| `logs-azure.platformlogs-*` | All other log categories |
8686

8787
### What about all other log categories?
8888

‎packages/azure/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: azure
22
title: Azure Logs
3-
version: "1.23.2"
3+
version: "1.23.3"
44
description: This Elastic integration collects logs from Azure
55
type: integration
66
icons:

‎packages/sentinel_one/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.34.2"
3+
changes:
4+
- description: Fix the `Activities by OS Family` visualization in the Activities dashboard.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/13943
27
- version: "1.34.1"
38
changes:
49
- description: Fix default request trace enabled behavior.

0 commit comments

Comments
 (0)