Skip to content

Commit d53d552

Browse files
LaZyDKLaZyDK
authored
[cisco_meraki] Add event.action and message to specific events (#7791)
Add event.action value when cisco_meraki.event_subtype is multiple_dhcp_servers_detected Keep important information in message field for cisco_meraki.event_subtype: * dhcp * client_vpn_connect * blocked * port
1 parent a14a5e9 commit d53d552

File tree

8 files changed

+61
-30
lines changed

8 files changed

+61
-30
lines changed

‎packages/cisco_meraki/changelog.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# newer versions go on top
2-
- version: 1.14.0
2+
- version: "1.15.0"
3+
changes:
4+
- description: Add event.action and message to specific events.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/7791
7+
- version: "1.14.0"
38
changes:
49
- description: ECS version updated to 8.10.0.
510
type: enhancement

‎packages/cisco_meraki/data_stream/events/sample_event.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"@timestamp": "2018-02-11T00:00:00.123Z",
33
"agent": {
4-
"ephemeral_id": "077a2d93-4b1d-4908-b2d5-7c3a0218df3a",
5-
"id": "878982e9-a174-4ed8-abe3-19378c1473de",
4+
"ephemeral_id": "9a78410b-655d-4ff4-9fd6-5c47d2b1e28b",
5+
"id": "29d48081-6d4f-4236-b959-925451410f6f",
66
"name": "docker-fleet-agent",
77
"type": "filebeat",
8-
"version": "8.8.0"
8+
"version": "8.0.0"
99
},
1010
"cisco_meraki": {
1111
"event": {
@@ -40,9 +40,9 @@
4040
"version": "8.10.0"
4141
},
4242
"elastic_agent": {
43-
"id": "878982e9-a174-4ed8-abe3-19378c1473de",
43+
"id": "29d48081-6d4f-4236-b959-925451410f6f",
4444
"snapshot": false,
45-
"version": "8.8.0"
45+
"version": "8.0.0"
4646
},
4747
"event": {
4848
"action": "Cellular came up",
@@ -51,7 +51,7 @@
5151
"network"
5252
],
5353
"dataset": "cisco_meraki.events",
54-
"ingested": "2023-06-01T20:29:21Z",
54+
"ingested": "2023-09-20T09:09:47Z",
5555
"original": "{\"alertData\":{\"connection\":\"LTE\",\"local\":\"192.168.1.2\",\"model\":\"UML290VW\",\"provider\":\"Purview Wireless\",\"remote\":\"1.2.3.5\"},\"alertId\":\"0000000000000000\",\"alertLevel\":\"informational\",\"alertType\":\"Cellular came up\",\"alertTypeId\":\"cellular_up\",\"deviceMac\":\"00:11:22:33:44:55\",\"deviceModel\":\"MX\",\"deviceName\":\"My appliance\",\"deviceSerial\":\"Q234-ABCD-5678\",\"deviceTags\":[\"tag1\",\"tag2\"],\"deviceUrl\":\"https://n1.meraki.com//n//manage/nodes/new_list/000000000000\",\"networkId\":\"N_24329156\",\"networkName\":\"Main Office\",\"networkTags\":[],\"networkUrl\":\"https://n1.meraki.com//n//manage/nodes/list\",\"occurredAt\":\"2018-02-11T00:00:00.123450Z\",\"organizationId\":\"2930418\",\"organizationName\":\"My organization\",\"organizationUrl\":\"https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview\",\"sentAt\":\"2021-10-07T08:42:00.926325Z\",\"sharedSecret\":\"secret\",\"version\":\"0.1\"}",
5656
"type": [
5757
"info",

‎packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,7 @@
362362
"allowed"
363363
]
364364
},
365+
"message": "lease of ip 10.0.2.213 from mx mac 68:3A:1E:42:60:59 for client mac E0:CB:BC:02:4F:80 from router 10.0.0.1 on subnet 255.255.252.0 with dns 10.0.0.1",
365366
"network": {
366367
"protocol": "dhcp"
367368
},
@@ -400,6 +401,7 @@
400401
"denied"
401402
]
402403
},
404+
"message": "no offers for mac A4:83:E7:02:A2:F1 host = 192.168.10.1",
403405
"network": {
404406
"protocol": "dhcp"
405407
},
@@ -449,6 +451,7 @@
449451
"start"
450452
]
451453
},
454+
"message": "user id 'jwick@wwvpn.net' local ip 172.16.0.145 connected from 81.2.69.193",
452455
"network": {
453456
"forwarded_ip": "172.16.0.145"
454457
},
@@ -667,6 +670,9 @@
667670
"version": "8.10.0"
668671
},
669672
"event": {
673+
"action": [
674+
"multiple_dhcp_servers_detected"
675+
],
670676
"category": [
671677
"network"
672678
],
@@ -718,6 +724,9 @@
718724
"version": "8.10.0"
719725
},
720726
"event": {
727+
"action": [
728+
"multiple_dhcp_servers_detected"
729+
],
721730
"category": [
722731
"network"
723732
],
@@ -1073,6 +1082,7 @@
10731082
"priority": 134
10741083
}
10751084
},
1085+
"message": "Blocked ARP Packet from ab:01:02:03:04:05 with IP 81.2.69.144 on VLAN 123",
10761086
"observer": {
10771087
"hostname": "TCP9001",
10781088
"ingress": {
@@ -1126,6 +1136,7 @@
11261136
"priority": 134
11271137
}
11281138
},
1139+
"message": "Port 4 changed STP role from designated to disabled",
11291140
"observer": {
11301141
"hostname": "TCP9001"
11311142
},
@@ -1158,6 +1169,7 @@
11581169
"priority": 134
11591170
}
11601171
},
1172+
"message": "port 4 status changed from 100fdx to down",
11611173
"observer": {
11621174
"hostname": "TCP9001"
11631175
},
@@ -1190,6 +1202,7 @@
11901202
"priority": 134
11911203
}
11921204
},
1205+
"message": "Port 1 changed STP role from disabled to designated",
11931206
"observer": {
11941207
"hostname": "TCP9001"
11951208
},
@@ -1222,6 +1235,7 @@
12221235
"priority": 134
12231236
}
12241237
},
1238+
"message": "port 1 status changed from down to 100fdx",
12251239
"observer": {
12261240
"hostname": "TCP9001"
12271241
},

‎packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,8 @@ processors:
213213
"multiple_dhcp_servers_detected":
214214
type:
215215
- protocol
216+
action:
217+
- multiple_dhcp_servers_detected
216218
"dfs_event":
217219
action: dynamic-frequency-selection-detected
218220
"aps_association_reject":

‎packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,11 @@ processors:
7070
field: cisco_meraki.event_subtype
7171
value: dhcp_no_offer
7272
if: ctx?.msgtype.toLowerCase() == "dhcp" && ctx?._temp?.dhcp_op.toLowerCase() == 'no' && ctx?._temp?.dhcp_op2.toLowerCase() == 'offers'
73+
- grok:
74+
field: event.original
75+
patterns:
76+
- "events dhcp %{GREEDYDATA:message}$"
77+
if: ctx?.msgtype.toLowerCase() == "dhcp"
7378
####################################################
7479
# Handle Site-to-Site VPN message
7580
####################################################
@@ -91,7 +96,7 @@ processors:
9196
- grok:
9297
field: event.original
9398
patterns:
94-
- '%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}%{BLOCKEDARP:_temp.blocked_arp} from %{MAC:source.mac} with IP %{IP:source.ip} on %{NOTSPACE} %{GREEDYDATA:observer.ingress.vlan.id}$'
99+
- '^%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}(?<message>%{BLOCKEDARP:_temp.blocked_arp} from %{MAC:source.mac} with IP %{IP:source.ip} on %{NOTSPACE} %{GREEDYDATA:observer.ingress.vlan.id})$'
95100
pattern_definitions:
96101
SYSLOGPRI: '<%{NONNEGINT:log.syslog.priority:long}>'
97102
SYSLOGVER: '\b(?:\d{1,2})\b'
@@ -118,7 +123,7 @@ processors:
118123
- grok:
119124
field: event.original
120125
patterns:
121-
- '(?i)%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}port %{NOTSPACE} %{PORTACTION:_temp.port_action}'
126+
- '^(?i)%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}(?<message>port %{NOTSPACE} %{PORTACTION:_temp.port_action}.*)$'
122127
pattern_definitions:
123128
SYSLOGPRI: '<%{NONNEGINT:log.syslog.priority:long}>'
124129
SYSLOGVER: '\b(?:\d{1,2})\b'
@@ -233,6 +238,11 @@ processors:
233238
field: event.original
234239
pattern: "%{} events client_vpn_connect user id '%{user.name}' local ip %{network.forwarded_ip} connected from %{_temp.client_ip}"
235240
if: ctx?.cisco_meraki?.event_subtype == "client_vpn_connect"
241+
- grok:
242+
field: event.original
243+
patterns:
244+
- "events client_vpn_connect %{GREEDYDATA:message}$"
245+
if: ctx?.cisco_meraki?.event_subtype == "client_vpn_connect"
236246
237247
####################################################
238248
# parse dissected IP values and convert to IP type

‎packages/cisco_meraki/data_stream/log/sample_event.json‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"@timestamp": "2021-11-23T18:13:18.348Z",
33
"agent": {
4-
"ephemeral_id": "eedc7205-9a4a-44e7-8574-3c9450a28434",
5-
"id": "878982e9-a174-4ed8-abe3-19378c1473de",
4+
"ephemeral_id": "6a7dac67-b13a-40d5-a45a-7df6ac73e739",
5+
"id": "29d48081-6d4f-4236-b959-925451410f6f",
66
"name": "docker-fleet-agent",
77
"type": "filebeat",
8-
"version": "8.8.0"
8+
"version": "8.0.0"
99
},
1010
"cisco_meraki": {
1111
"event_subtype": "ids_alerted",
@@ -30,9 +30,9 @@
3030
"version": "8.10.0"
3131
},
3232
"elastic_agent": {
33-
"id": "878982e9-a174-4ed8-abe3-19378c1473de",
33+
"id": "29d48081-6d4f-4236-b959-925451410f6f",
3434
"snapshot": false,
35-
"version": "8.8.0"
35+
"version": "8.0.0"
3636
},
3737
"event": {
3838
"action": "ids-signature-matched",
@@ -42,7 +42,7 @@
4242
"threat"
4343
],
4444
"dataset": "cisco_meraki.log",
45-
"ingested": "2023-06-01T20:31:15Z",
45+
"ingested": "2023-09-20T09:12:35Z",
4646
"original": "\u003c134\u003e1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected",
4747
"type": [
4848
"info",
@@ -54,7 +54,7 @@
5454
},
5555
"log": {
5656
"source": {
57-
"address": "192.168.224.4:50508"
57+
"address": "172.20.0.4:40170"
5858
}
5959
},
6060
"network": {

‎packages/cisco_meraki/docs/README.md‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -298,11 +298,11 @@ An example event for `log` looks as following:
298298
{
299299
"@timestamp": "2021-11-23T18:13:18.348Z",
300300
"agent": {
301-
"ephemeral_id": "eedc7205-9a4a-44e7-8574-3c9450a28434",
302-
"id": "878982e9-a174-4ed8-abe3-19378c1473de",
301+
"ephemeral_id": "6a7dac67-b13a-40d5-a45a-7df6ac73e739",
302+
"id": "29d48081-6d4f-4236-b959-925451410f6f",
303303
"name": "docker-fleet-agent",
304304
"type": "filebeat",
305-
"version": "8.8.0"
305+
"version": "8.0.0"
306306
},
307307
"cisco_meraki": {
308308
"event_subtype": "ids_alerted",
@@ -327,9 +327,9 @@ An example event for `log` looks as following:
327327
"version": "8.10.0"
328328
},
329329
"elastic_agent": {
330-
"id": "878982e9-a174-4ed8-abe3-19378c1473de",
330+
"id": "29d48081-6d4f-4236-b959-925451410f6f",
331331
"snapshot": false,
332-
"version": "8.8.0"
332+
"version": "8.0.0"
333333
},
334334
"event": {
335335
"action": "ids-signature-matched",
@@ -339,7 +339,7 @@ An example event for `log` looks as following:
339339
"threat"
340340
],
341341
"dataset": "cisco_meraki.log",
342-
"ingested": "2023-06-01T20:31:15Z",
342+
"ingested": "2023-09-20T09:12:35Z",
343343
"original": "\u003c134\u003e1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected",
344344
"type": [
345345
"info",
@@ -351,7 +351,7 @@ An example event for `log` looks as following:
351351
},
352352
"log": {
353353
"source": {
354-
"address": "192.168.224.4:50508"
354+
"address": "172.20.0.4:40170"
355355
}
356356
},
357357
"network": {
@@ -623,11 +623,11 @@ An example event for `events` looks as following:
623623
{
624624
"@timestamp": "2018-02-11T00:00:00.123Z",
625625
"agent": {
626-
"ephemeral_id": "077a2d93-4b1d-4908-b2d5-7c3a0218df3a",
627-
"id": "878982e9-a174-4ed8-abe3-19378c1473de",
626+
"ephemeral_id": "9a78410b-655d-4ff4-9fd6-5c47d2b1e28b",
627+
"id": "29d48081-6d4f-4236-b959-925451410f6f",
628628
"name": "docker-fleet-agent",
629629
"type": "filebeat",
630-
"version": "8.8.0"
630+
"version": "8.0.0"
631631
},
632632
"cisco_meraki": {
633633
"event": {
@@ -662,9 +662,9 @@ An example event for `events` looks as following:
662662
"version": "8.10.0"
663663
},
664664
"elastic_agent": {
665-
"id": "878982e9-a174-4ed8-abe3-19378c1473de",
665+
"id": "29d48081-6d4f-4236-b959-925451410f6f",
666666
"snapshot": false,
667-
"version": "8.8.0"
667+
"version": "8.0.0"
668668
},
669669
"event": {
670670
"action": "Cellular came up",
@@ -673,7 +673,7 @@ An example event for `events` looks as following:
673673
"network"
674674
],
675675
"dataset": "cisco_meraki.events",
676-
"ingested": "2023-06-01T20:29:21Z",
676+
"ingested": "2023-09-20T09:09:47Z",
677677
"original": "{\"alertData\":{\"connection\":\"LTE\",\"local\":\"192.168.1.2\",\"model\":\"UML290VW\",\"provider\":\"Purview Wireless\",\"remote\":\"1.2.3.5\"},\"alertId\":\"0000000000000000\",\"alertLevel\":\"informational\",\"alertType\":\"Cellular came up\",\"alertTypeId\":\"cellular_up\",\"deviceMac\":\"00:11:22:33:44:55\",\"deviceModel\":\"MX\",\"deviceName\":\"My appliance\",\"deviceSerial\":\"Q234-ABCD-5678\",\"deviceTags\":[\"tag1\",\"tag2\"],\"deviceUrl\":\"https://n1.meraki.com//n//manage/nodes/new_list/000000000000\",\"networkId\":\"N_24329156\",\"networkName\":\"Main Office\",\"networkTags\":[],\"networkUrl\":\"https://n1.meraki.com//n//manage/nodes/list\",\"occurredAt\":\"2018-02-11T00:00:00.123450Z\",\"organizationId\":\"2930418\",\"organizationName\":\"My organization\",\"organizationUrl\":\"https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview\",\"sentAt\":\"2021-10-07T08:42:00.926325Z\",\"sharedSecret\":\"secret\",\"version\":\"0.1\"}",
678678
"type": [
679679
"info",

‎packages/cisco_meraki/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 2.11.0
22
name: cisco_meraki
33
title: Cisco Meraki
4-
version: "1.14.0"
4+
version: "1.15.0"
55
description: Collect logs from Cisco Meraki with Elastic Agent.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)