Skip to content

Commit 9a94e0f

Browse files
efd6efd6
authored
panw: allow dollar sign at the end of a user name (#5886)
This allows a use where machine accounts are tagged in Active Directory with a dollar sign[1]. [1]https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oN0iCAE&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail
1 parent 7f4a623 commit 9a94e0f

File tree

5 files changed

+215
-6
lines changed

5 files changed

+215
-6
lines changed

‎packages/panw/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.7.1"
3+
changes:
4+
- description: Fix handling of usernames terminated with a dollar sign.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/5886
27
- version: "3.7.0"
38
changes:
49
- description: Enable RFC 6587 framing by default on TCP input.

‎packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-traffic-sample.log‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,4 +197,5 @@ Nov 30 16:09:52 PA-220 1,2018/11/30 16:09:52,012801096514,TRAFFIC,end,2049,2018/
197197
1,2021/10/26 14:31:37,,TRAFFIC,end,2561,2021/10/26 14:31:37,81.2.69.144,81.2.69.145,,,intrazone-default,,,syslog,vsys1,LAN,LAN,ethernet1/2,ethernet1/2,LFPpan,2021/10/26 14:31:37,15840,1,43096,30514,0,0,0x10005e,udp,allow,2544,1364,1180,4,2021/10/26 14:31:01,0,any,,7022390495259151733,0x0,United States,United States,,2,2,aged-out,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:37.773-07:00
198198
1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,192.168.10.111,81.2.69.193,LAn-TO-WAn,,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15845,1,64898,53,60860,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151732,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.773-07:00
199199
1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,192.168.10.111,81.2.69.193,LAn-TO-WAn,,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15844,1,64624,53,32849,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151731,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00
200-
1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,0.0.0.0,0.0.0.0,any to Intranet DCs,intranet\\sampleuser,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15844,1,64624,53,32849,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151731,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00
200+
1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,0.0.0.0,0.0.0.0,any to Intranet DCs,intranet\\sampleuser,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15844,1,64624,53,32849,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151731,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00
201+
1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,0.0.0.0,0.0.0.0,any to Intranet DCs,intranet\\sampleuser$,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15844,1,64624,53,32849,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151731,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00

‎packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-traffic-sample.log-expected.json‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36964,6 +36964,205 @@
3696436964
"domain": "intranet",
3696536965
"name": "sampleuser"
3696636966
}
36967+
},
36968+
{
36969+
"@timestamp": "2021-10-26T14:31:32.000Z",
36970+
"destination": {
36971+
"bytes": 0,
36972+
"geo": {
36973+
"city_name": "London",
36974+
"continent_name": "Europe",
36975+
"country_iso_code": "GB",
36976+
"country_name": "United Kingdom",
36977+
"location": {
36978+
"lat": 51.5142,
36979+
"lon": -0.0931
36980+
},
36981+
"name": "United States",
36982+
"region_iso_code": "GB-ENG",
36983+
"region_name": "England"
36984+
},
36985+
"ip": "81.2.69.193",
36986+
"nat": {
36987+
"ip": "0.0.0.0",
36988+
"port": 53
36989+
},
36990+
"packets": 0,
36991+
"port": 53
36992+
},
36993+
"ecs": {
36994+
"version": "8.7.0"
36995+
},
36996+
"event": {
36997+
"action": "flow_started",
36998+
"category": [
36999+
"network"
37000+
],
37001+
"created": "2021-10-26T14:31:32.000Z",
37002+
"duration": 0,
37003+
"end": "2021-10-26T14:31:31.000Z",
37004+
"kind": "event",
37005+
"original": "1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,0.0.0.0,0.0.0.0,any to Intranet DCs,intranet\\\\sampleuser$,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15844,1,64624,53,32849,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151731,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy,\" \", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00",
37006+
"outcome": "success",
37007+
"start": "2021-10-26T14:31:31.000Z",
37008+
"timezone": "UTC",
37009+
"type": [
37010+
"allowed",
37011+
"start",
37012+
"connection"
37013+
]
37014+
},
37015+
"labels": {
37016+
"nat_translated": true
37017+
},
37018+
"message": "81.2.69.193,81.2.69.193,0.0.0.0,0.0.0.0,any to Intranet DCs,intranet\\\\sampleuser$,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15844,1,64624,53,32849,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151731,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy,\" \", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00",
37019+
"network": {
37020+
"application": "dns",
37021+
"bytes": 93,
37022+
"community_id": [
37023+
"1:LaJxrnU+dNDHQ53Fp5twINgnUAI=",
37024+
"1:KJr4kMrCX4J3CX6oZjAeXy6e7CQ="
37025+
],
37026+
"packets": 1,
37027+
"transport": "udp",
37028+
"type": "ipv4"
37029+
},
37030+
"observer": {
37031+
"egress": {
37032+
"interface": {
37033+
"name": "ethernet1/1"
37034+
},
37035+
"zone": "WAN"
37036+
},
37037+
"hostname": "PA-VM",
37038+
"ingress": {
37039+
"interface": {
37040+
"name": "ethernet1/2"
37041+
},
37042+
"zone": "LAN"
37043+
},
37044+
"product": "PAN-OS",
37045+
"type": "firewall",
37046+
"vendor": "Palo Alto Networks"
37047+
},
37048+
"panw": {
37049+
"panos": {
37050+
"action": "allow",
37051+
"action_flags": "0x0",
37052+
"action_source": "from-policy",
37053+
"bytes_received": 0,
37054+
"bytes_sent": 93,
37055+
"destination": {
37056+
"ip": "81.2.69.193",
37057+
"location": "United States",
37058+
"nat": {
37059+
"ip": "0.0.0.0",
37060+
"port": 53
37061+
},
37062+
"port": 53,
37063+
"zone": "WAN"
37064+
},
37065+
"device_group_hierarchy1": "0",
37066+
"device_group_hierarchy2": "0",
37067+
"device_group_hierarchy3": "0",
37068+
"device_group_hierarchy4": "0",
37069+
"device_name": "PA-VM",
37070+
"elapsed_time": 0,
37071+
"endreason": "n/a",
37072+
"flow_id": "15844",
37073+
"generated_time": "2021-10-26T14:31:32.000Z",
37074+
"inbound_interface": "ethernet1/2",
37075+
"log_profile": "LFPpan",
37076+
"network": {
37077+
"application": "dns",
37078+
"bytes": 93,
37079+
"nat": {
37080+
"community_id": "1:KJr4kMrCX4J3CX6oZjAeXy6e7CQ="
37081+
},
37082+
"packets": 1
37083+
},
37084+
"outbound_interface": "ethernet1/1",
37085+
"packets_received": 0,
37086+
"packets_sent": 1,
37087+
"protocol": "udp",
37088+
"received_time": "2021-10-26T14:31:32.000Z",
37089+
"repeat_count": 1,
37090+
"ruleset": "any to Intranet DCs",
37091+
"sequence_number": "7022390495259151731",
37092+
"source": {
37093+
"ip": "81.2.69.193",
37094+
"location": "169.254.0.0-169.254.255.255",
37095+
"nat": {
37096+
"ip": "0.0.0.0",
37097+
"port": 32849
37098+
},
37099+
"port": 64624,
37100+
"user": "sampleuser$",
37101+
"zone": "LAN"
37102+
},
37103+
"source_vm_uuid": " ",
37104+
"src": {
37105+
"profile": " , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00"
37106+
},
37107+
"start_time": "2021-10-26T14:31:31.000Z",
37108+
"sub_type": "start",
37109+
"type": "TRAFFIC",
37110+
"url": {
37111+
"category": "any"
37112+
},
37113+
"virtual_sys": "vsys1"
37114+
}
37115+
},
37116+
"related": {
37117+
"hosts": [
37118+
"PA-VM"
37119+
],
37120+
"ip": [
37121+
"81.2.69.193",
37122+
"0.0.0.0"
37123+
],
37124+
"user": [
37125+
"sampleuser$"
37126+
]
37127+
},
37128+
"rule": {
37129+
"name": "any to Intranet DCs"
37130+
},
37131+
"source": {
37132+
"bytes": 93,
37133+
"geo": {
37134+
"city_name": "London",
37135+
"continent_name": "Europe",
37136+
"country_iso_code": "GB",
37137+
"country_name": "United Kingdom",
37138+
"location": {
37139+
"lat": 51.5142,
37140+
"lon": -0.0931
37141+
},
37142+
"name": "169.254.0.0-169.254.255.255",
37143+
"region_iso_code": "GB-ENG",
37144+
"region_name": "England"
37145+
},
37146+
"ip": "81.2.69.193",
37147+
"nat": {
37148+
"ip": "0.0.0.0",
37149+
"port": 32849
37150+
},
37151+
"packets": 1,
37152+
"port": 64624,
37153+
"user": {
37154+
"domain": "intranet",
37155+
"name": "sampleuser$"
37156+
}
37157+
},
37158+
"tags": [
37159+
"preserve_original_event",
37160+
"preserve_duplicate_custom_fields"
37161+
],
37162+
"user": {
37163+
"domain": "intranet",
37164+
"name": "sampleuser$"
37165+
}
3696737166
}
3696837167
]
3696937168
}

‎packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,20 +104,24 @@ processors:
104104
field: _temp_.srcuser
105105
ignore_missing: true
106106
patterns:
107-
- '^%{HOSTNAME:source.user.domain}\\%{USERNAME:source.user.name}$'
108-
- '^%{HOSTNAME:source.user.domain}\\\\%{USERNAME:source.user.name}$'
107+
- '^%{HOSTNAME:source.user.domain}\\%{USERNAMEM:source.user.name}$'
108+
- '^%{HOSTNAME:source.user.domain}\\\\%{USERNAMEM:source.user.name}$'
109109
- '^%{USERNAME:source.user.name}@%{HOSTNAME:source.user.domain}$'
110110
- '^%{USERNAME:source.user.name}$'
111+
pattern_definitions:
112+
USERNAMEM: '%{USERNAME}[$]?'
111113
if: ctx._temp_?.srcuser != null
112114

113115
- grok:
114116
field: _temp_.dstuser
115117
ignore_missing: true
116118
patterns:
117-
- '^%{HOSTNAME:destination.user.domain}\\%{USERNAME:destination.user.name}$'
118-
- '^%{HOSTNAME:destination.user.domain}\\\\%{USERNAME:destination.user.name}$'
119+
- '^%{HOSTNAME:destination.user.domain}\\%{USERNAMEM:destination.user.name}$'
120+
- '^%{HOSTNAME:destination.user.domain}\\\\%{USERNAMEM:destination.user.name}$'
119121
- '^%{USERNAME:destination.user.name}@%{HOSTNAME:destination.user.domain}$'
120122
- '^%{USERNAME:destination.user.name}$'
123+
pattern_definitions:
124+
USERNAMEM: '%{USERNAME}[$]?'
121125
if: ctx._temp_?.dstuser != null
122126

123127
- set:

‎packages/panw/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: panw
22
title: Palo Alto Next-Gen Firewall
3-
version: "3.7.0"
3+
version: "3.7.1"
44
release: ga
55
description: Collect logs from Palo Alto next-gen firewalls with Elastic Agent.
66
type: integration

0 commit comments

Comments
 (0)