Skip to content

Commit b50e26b

Browse files
kcreddykcreddy
committed
Eclectiq - Fix ECS date mapping on threat fields
1 parent 990197f commit b50e26b

File tree

5 files changed

+117
-25
lines changed

5 files changed

+117
-25
lines changed

‎packages/ti_eclecticiq/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.2.1"
3+
changes:
4+
- description: Fix ECS date mapping on threat fields.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/10674
27
- version: "1.2.0"
38
changes:
49
- description: Increase CEL resource.tracer.maxsize to prevent loss of trace responses.

‎packages/ti_eclecticiq/data_stream/threat/fields/ecs.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
- external: ecs
2+
name: threat.indicator.first_seen
3+
- external: ecs
4+
name: threat.indicator.last_seen
5+
- external: ecs
6+
name: threat.indicator.modified_at

‎packages/ti_eclecticiq/data_stream/threat/sample_event.json‎

Lines changed: 51 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,75 @@
11
{
2-
"@timestamp": "2023-06-20T18:06:10.126Z",
2+
"@timestamp": "2023-01-01T00:00:00.000Z",
3+
"agent": {
4+
"ephemeral_id": "cf201e4c-c043-4a07-baa4-2227c8fbb4c3",
5+
"id": "8299ae35-ee0e-4107-9acb-1b6acfdda1fb",
6+
"name": "docker-fleet-agent",
7+
"type": "filebeat",
8+
"version": "8.13.0"
9+
},
10+
"data_stream": {
11+
"dataset": "ti_eclecticiq.threat",
12+
"namespace": "14085",
13+
"type": "logs"
14+
},
315
"eclecticiq": {
416
"threat": {
5-
"observable_id": "AyGp2BbK9uP5CeLPYv/uuQlDxC8="
17+
"observable_id": "OwWGOybxVeL+USaXvDQSNonD5eU="
618
}
719
},
820
"ecs": {
921
"version": "8.11.0"
1022
},
23+
"elastic_agent": {
24+
"id": "8299ae35-ee0e-4107-9acb-1b6acfdda1fb",
25+
"snapshot": false,
26+
"version": "8.13.0"
27+
},
1128
"event": {
29+
"agent_id_status": "verified",
1230
"category": [
1331
"threat"
1432
],
15-
"created": "2023-06-08T12:00:30.187Z",
33+
"created": "2023-06-08T12:00:30.028Z",
1634
"dataset": "ti_eclecticiq.threat",
17-
"id": "XugasX/Bvu/150lNyQjzIGR0zZ8=",
35+
"id": "ZgAq/IXlrjc2J5AdLsDMWhENshI=",
36+
"ingested": "2024-08-02T04:24:34Z",
1837
"kind": "enrichment",
19-
"original": "{\"calculated.relevancy\": \"0.68\", \"calculated.source_reliability\": \"A\", \"calculated.tlp\": \"GREEN\", \"diff\": \"add\", \"entity.id\": \"5e814485-012d-423d-b769-026bfed0f451\", \"entity.title\": \"Example\", \"entity.type\": \"malware\", \"meta.classification\": \"\", \"meta.confidence\": \"\", \"meta.entity_url\": \"https://test.com/entity/5e814485-012d-423d-b769-026bfed0f451\", \"meta.estimated_observed_time\": \"2019-07-09T17:42:44.777000+00:00\", \"meta.estimated_threat_end_time\": \"\", \"meta.estimated_threat_start_time\": \"2022-05-11T14:00:00.188000+00:00\", \"meta.ingest_time\": \"2023-06-08T12:00:30.187097+00:00\", \"meta.relevancy\": \"0.68\", \"meta.source_reliability\": \"A\", \"meta.tags\": \"tag1;tag2\", \"meta.taxonomy\": \"\", \"meta.terms_of_use\": \"\", \"meta.tlp\": \"GREEN\", \"source.ids\": \"47ec245c-9e7b-467e-a016-77a22ff12dd5\", \"source.names\": \"Test Source\", \"timestamp\": \"2023-06-20 18:06:10.126780+00:00\", \"type\": \"domain\", \"value\": \"example.com\", \"value_url\": \"https://test.com/main/extracts/domain/test\"}",
20-
"provider": "Test Source",
21-
"start": "2022-05-11T14:00:00.188Z",
38+
"provider": "Test",
39+
"start": "2021-12-19T00:27:19.108Z",
2240
"type": [
2341
"indicator"
2442
],
2543
"url": "https://www.test.com/"
2644
},
27-
"tags": [
28-
"tag1",
29-
"tag2"
30-
],
45+
"host": {
46+
"architecture": "aarch64",
47+
"containerized": false,
48+
"hostname": "docker-fleet-agent",
49+
"id": "8269eab9370b4429947d2a16c3058fcb",
50+
"ip": [
51+
"172.29.0.7"
52+
],
53+
"mac": [
54+
"02-42-AC-1D-00-07"
55+
],
56+
"name": "docker-fleet-agent",
57+
"os": {
58+
"codename": "focal",
59+
"family": "debian",
60+
"kernel": "6.4.16-linuxkit",
61+
"name": "Ubuntu",
62+
"platform": "ubuntu",
63+
"type": "linux",
64+
"version": "20.04.6 LTS (Focal Fossa)"
65+
}
66+
},
67+
"input": {
68+
"type": "cel"
69+
},
3170
"threat": {
3271
"indicator": {
33-
"first_seen": "2019-07-09T17:42:44.777Z",
72+
"first_seen": "2021-12-19T00:27:19.108Z",
3473
"marking": {
3574
"tlp": "GREEN"
3675
},

‎packages/ti_eclecticiq/docs/README.md‎

Lines changed: 54 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -179,38 +179,77 @@ An example event for `threat` looks as following:
179179

180180
```json
181181
{
182-
"@timestamp": "2023-06-20T18:06:10.126Z",
182+
"@timestamp": "2023-01-01T00:00:00.000Z",
183+
"agent": {
184+
"ephemeral_id": "cf201e4c-c043-4a07-baa4-2227c8fbb4c3",
185+
"id": "8299ae35-ee0e-4107-9acb-1b6acfdda1fb",
186+
"name": "docker-fleet-agent",
187+
"type": "filebeat",
188+
"version": "8.13.0"
189+
},
190+
"data_stream": {
191+
"dataset": "ti_eclecticiq.threat",
192+
"namespace": "14085",
193+
"type": "logs"
194+
},
183195
"eclecticiq": {
184196
"threat": {
185-
"observable_id": "AyGp2BbK9uP5CeLPYv/uuQlDxC8="
197+
"observable_id": "OwWGOybxVeL+USaXvDQSNonD5eU="
186198
}
187199
},
188200
"ecs": {
189201
"version": "8.11.0"
190202
},
203+
"elastic_agent": {
204+
"id": "8299ae35-ee0e-4107-9acb-1b6acfdda1fb",
205+
"snapshot": false,
206+
"version": "8.13.0"
207+
},
191208
"event": {
209+
"agent_id_status": "verified",
192210
"category": [
193211
"threat"
194212
],
195-
"created": "2023-06-08T12:00:30.187Z",
213+
"created": "2023-06-08T12:00:30.028Z",
196214
"dataset": "ti_eclecticiq.threat",
197-
"id": "XugasX/Bvu/150lNyQjzIGR0zZ8=",
215+
"id": "ZgAq/IXlrjc2J5AdLsDMWhENshI=",
216+
"ingested": "2024-08-02T04:24:34Z",
198217
"kind": "enrichment",
199-
"original": "{\"calculated.relevancy\": \"0.68\", \"calculated.source_reliability\": \"A\", \"calculated.tlp\": \"GREEN\", \"diff\": \"add\", \"entity.id\": \"5e814485-012d-423d-b769-026bfed0f451\", \"entity.title\": \"Example\", \"entity.type\": \"malware\", \"meta.classification\": \"\", \"meta.confidence\": \"\", \"meta.entity_url\": \"https://test.com/entity/5e814485-012d-423d-b769-026bfed0f451\", \"meta.estimated_observed_time\": \"2019-07-09T17:42:44.777000+00:00\", \"meta.estimated_threat_end_time\": \"\", \"meta.estimated_threat_start_time\": \"2022-05-11T14:00:00.188000+00:00\", \"meta.ingest_time\": \"2023-06-08T12:00:30.187097+00:00\", \"meta.relevancy\": \"0.68\", \"meta.source_reliability\": \"A\", \"meta.tags\": \"tag1;tag2\", \"meta.taxonomy\": \"\", \"meta.terms_of_use\": \"\", \"meta.tlp\": \"GREEN\", \"source.ids\": \"47ec245c-9e7b-467e-a016-77a22ff12dd5\", \"source.names\": \"Test Source\", \"timestamp\": \"2023-06-20 18:06:10.126780+00:00\", \"type\": \"domain\", \"value\": \"example.com\", \"value_url\": \"https://test.com/main/extracts/domain/test\"}",
200-
"provider": "Test Source",
201-
"start": "2022-05-11T14:00:00.188Z",
218+
"provider": "Test",
219+
"start": "2021-12-19T00:27:19.108Z",
202220
"type": [
203221
"indicator"
204222
],
205223
"url": "https://www.test.com/"
206224
},
207-
"tags": [
208-
"tag1",
209-
"tag2"
210-
],
225+
"host": {
226+
"architecture": "aarch64",
227+
"containerized": false,
228+
"hostname": "docker-fleet-agent",
229+
"id": "8269eab9370b4429947d2a16c3058fcb",
230+
"ip": [
231+
"172.29.0.7"
232+
],
233+
"mac": [
234+
"02-42-AC-1D-00-07"
235+
],
236+
"name": "docker-fleet-agent",
237+
"os": {
238+
"codename": "focal",
239+
"family": "debian",
240+
"kernel": "6.4.16-linuxkit",
241+
"name": "Ubuntu",
242+
"platform": "ubuntu",
243+
"type": "linux",
244+
"version": "20.04.6 LTS (Focal Fossa)"
245+
}
246+
},
247+
"input": {
248+
"type": "cel"
249+
},
211250
"threat": {
212251
"indicator": {
213-
"first_seen": "2019-07-09T17:42:44.777Z",
252+
"first_seen": "2021-12-19T00:27:19.108Z",
214253
"marking": {
215254
"tlp": "GREEN"
216255
},
@@ -241,4 +280,7 @@ An example event for `threat` looks as following:
241280
| input.type | Input type | keyword |
242281
| labels.is_ioc_transform_source | Field indicating if its the transform source for supporting IOC expiration. This field is dropped from destination indices to facilitate easier filtering of indicators. | constant_keyword |
243282
| threat.feed.name | Display friendly feed name | constant_keyword |
283+
| threat.indicator.first_seen | The date and time when intelligence source first reported sighting this indicator. | date |
284+
| threat.indicator.last_seen | The date and time when intelligence source last reported sighting this indicator. | date |
285+
| threat.indicator.modified_at | The date and time when intelligence source last modified information for this indicator. | date |
244286

‎packages/ti_eclecticiq/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.0.3
22
name: ti_eclecticiq
33
title: EclecticIQ
4-
version: "1.2.0"
4+
version: "1.2.1"
55
description: Ingest threat intelligence from EclecticIQ with Elastic Agent
66
type: integration
77
categories:

0 commit comments

Comments
 (0)