Skip to content

Commit e3dba03

Browse files
taylor-swansontaylor-swanson
authored
[panw] Replace syslog input with UDP/TCP input and syslog processor (#3323)
- Replace syslog input with UDP and TCP input, now requires 8.2.1 or later - TCP input supports TLS and custom options - Add system tests for TCP/TLS input
1 parent 98a174f commit e3dba03

File tree

15 files changed

+536
-72
lines changed

15 files changed

+536
-72
lines changed

‎packages/panw/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,18 @@ services:
66
- ./sample_logs:/sample_logs:ro
77
- ${SERVICE_LOGS_DIR}:/var/log
88
command: /bin/sh -c "cp /sample_logs/* /var/log/"
9-
panw-panos-syslog:
10-
image: akroh/stream:v0.0.1
9+
panw-panos-tls:
10+
image: docker.elastic.co/observability/stream:v0.6.2
1111
volumes:
12-
- ./sample_logs:/sample_logs:ro
12+
- ./syslog_logs:/sample_logs:ro
13+
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=tls --insecure /sample_logs/panw-panos-traffic.log
14+
panw-panos-tcp:
15+
image: docker.elastic.co/observability/stream:v0.6.2
16+
volumes:
17+
- ./syslog_logs:/sample_logs:ro
18+
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/panw-panos-traffic.log
19+
panw-panos-udp:
20+
image: docker.elastic.co/observability/stream:v0.6.2
21+
volumes:
22+
- ./syslog_logs:/sample_logs:ro
1323
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=udp /sample_logs/panw-panos-traffic.log

‎packages/panw/_dev/deploy/docker/syslog_logs/panw-panos-traffic.log‎

Lines changed: 200 additions & 0 deletions
Large diffs are not rendered by default.

‎packages/panw/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.2.0"
3+
changes:
4+
- description: Replace syslog input with UDP/TCP input and syslog processor.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/3323
27
- version: "2.1.0"
38
changes:
49
- description: Add GeoIP/ASN data for `*.nat.ip` fields

‎packages/panw/data_stream/panos/_dev/test/system/test-syslog-config.yml‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎packages/panw/data_stream/panos/_dev/test/system/test-tcp-config.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
service: panw-panos-tcp
2+
service_notify_signal: SIGHUP
3+
input: tcp
4+
data_stream:
5+
vars:
6+
syslog_host: 0.0.0.0
7+
syslog_port: 9514

‎packages/panw/data_stream/panos/_dev/test/system/test-tls-config.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
service: panw-panos-tls
2+
service_notify_signal: SIGHUP
3+
input: tcp
4+
data_stream:
5+
vars:
6+
syslog_host: 0.0.0.0
7+
syslog_port: 9515
8+
ssl: |
9+
key: |
10+
-----BEGIN PRIVATE KEY-----
11+
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDhCLvLsQAHufsN
12+
U+u1x/CequAUphfXZqLhDo2Eo/holfBS0+ey4bnzPL6lS9NFL5JkLQA2gYESqsXU
13+
/Ru8E76Az1egzMwT3TVAPLVU8NbrxBqeNiQa2m9wC37HQy4qC9OxL28LUoKtFjxS
14+
cD1sa0oikXCJN1a3BSoAf9iiZ/dxz4WVfrNhrzq2JFXjravY84n5ujkZOg45Pg70
15+
4vHOeg0rBbIoSNfjDUVZWjwC95K1BMN3msOTL9juv/EDa6BujqCxl+G1nY7JPFDL
16+
SHWis65p+1AAa5xieYDb47vyJ0SSR7lEURTXZOkkM6k5JWfgkATEmGzRxPkOloIT
17+
Xg9ag1OlAgMBAAECggEAEHfPJmzhj68wjB0kFr13AmWG2Hv/Kqg8KzQhbx+AwkaW
18+
u7j+L70NGpvLZ9VQtLNyhxoz9cksZO1SZO/Q48aeHlcOFppmJN3/U6AdtQWa9M35
19+
FLLpmX16wjxVHsfvzOvopgLOoYl8PqZt66qDFDgVyMnT7na6RdJ+7GJuvBPXq+Bc
20+
vgThvAZitHSAOhnBFYmTMlBi6AzOMMsaFlgE3Xf9v3M0pAKItPRKMhXlC3MyvA/v
21+
jgbra4Ib+0ryohggHheHB3bn3Jgv7iFKoW9OQSePVxacJ+kfr9H+No5g495URzqR
22+
mx/96WCiv3rAh3ct8Sk/C4/3zMC8fUueDJIVjhgw0QKBgQD8NufLINNkIpBrLoCS
23+
972oFEjZB2u6EusQ7X9raROqpaw26ZSu+zSHeIKCGQ93M3aRb3FpdGeOxgZ095MV
24+
8a+nlh4stOvHj2Mm5YhTBDUavTC7o9aVR3Od5eTXUpHnaJpNI/uyIcKupeK1UJnV
25+
UlBLeIwo/vJ1gsVrKMMAJkuKbwKBgQDkaWRRd0w2gUIbCTGf203BqXft0VdIiOW7
26+
+gnkeaNHAf09XljzxMcQzrB8kG63aKVGbJffphEfzxtiJ+HRQVH+7QpKRhU/GHmu
27+
+6OKkxTcxJm5zhoRFxcSi2wG4PWmUGJvc7ss1OJGcaOUxwocCepO7N/jfdDz9Uke
28+
KnA+YWOdKwKBgQDteZkYlojT0QOgF8HyH5gQyUCqMKWLJ0LzxltiPCbLV4Dml1pq
29+
w5Z7M8nWS1hXiTpLx93GSFc1hFkSCwYP9GfK6Lryp0sVtHnMZvTMDbseuSJImwRx
30+
vDwtYQfugg1lEQWwOoBEAiu3m/PxernNtNprpU57T0nlwUK3GkM5QdWAuwKBgQCZ
31+
ZF3GiANapzupxGbbH//8Cr9LqsafI7CEqMpz8WxBh4h16iJ6sq+tDeFgBe8UpOY5
32+
gTwNKg1d+0w8guQYD3HtbWr3rlEeamVtqfiOW3ArQqyqJ0tCJuuLvK3zgKf35Qv2
33+
JRaSaPT8sdxVUcXsRoxgLJu+vwPQke1koMN4YRbwuQKBgQDJiZ/WSeqa5oIqkXbn
34+
hjm7RXKaf2oE1U/bNjdSFtdEP7T4vUvvr7Hq2f/jiBLtCE7w16PJjKx9iIq2+jMl
35+
qIY43Sk9bdi5FxtYTHda0hwrbH274P+QVcVs5PXCT0TGktOleHGBlXaaPrxl9iCh
36+
8tmmxZZYa5aQxEO/lxB9xQKaiQ==
37+
-----END PRIVATE KEY-----
38+
certificate: |
39+
-----BEGIN CERTIFICATE-----
40+
MIIDazCCAlOgAwIBAgIUW5TDu1tJMY2Oa7PsL+BQSmeWqz0wDQYJKoZIhvcNAQEL
41+
BQAwRTELMAkGA1UEBhMCVVMxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
42+
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMTEwMDEwNTAwMjNaFw0yMTEw
43+
MDIwNTAwMjNaMEUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
44+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
45+
AQUAA4IBDwAwggEKAoIBAQDhCLvLsQAHufsNU+u1x/CequAUphfXZqLhDo2Eo/ho
46+
lfBS0+ey4bnzPL6lS9NFL5JkLQA2gYESqsXU/Ru8E76Az1egzMwT3TVAPLVU8Nbr
47+
xBqeNiQa2m9wC37HQy4qC9OxL28LUoKtFjxScD1sa0oikXCJN1a3BSoAf9iiZ/dx
48+
z4WVfrNhrzq2JFXjravY84n5ujkZOg45Pg704vHOeg0rBbIoSNfjDUVZWjwC95K1
49+
BMN3msOTL9juv/EDa6BujqCxl+G1nY7JPFDLSHWis65p+1AAa5xieYDb47vyJ0SS
50+
R7lEURTXZOkkM6k5JWfgkATEmGzRxPkOloITXg9ag1OlAgMBAAGjUzBRMB0GA1Ud
51+
DgQWBBRYUSKDHBBE9Q6fTeTqogicCxcXwDAfBgNVHSMEGDAWgBRYUSKDHBBE9Q6f
52+
TeTqogicCxcXwDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBc
53+
T8B+GpvPy9NQ700LsywRPY0L9IJCKiu6j3TP1tqqSPjAC/cg9ac+bFXuWOu7V+KJ
54+
s09Q/pItq9SLX6UvnfRzTxu5lCBwwGX9cL131mTIu5SmFo7Eks+sorbiIarWDMoC
55+
e+9An3GFpagW+YhOt4BdIM5lTqoeodzganDBsOUZI9aDAj2Yo5h2O7r6Wd12cb6T
56+
mz8vMfB2eG8BxU20ZMfkdERWjiyXHOSBQqeqfkV8d9370gMu5RcJNcIgnbmTRdho
57+
X3HJFiimZVaNjXATqmC/y2A1KXvJdamPLy3mGXkW2cFLoPCdK2OZFUHqiuc1bigA
58+
qEf55SihFqErRMeURPPF
59+
-----END CERTIFICATE-----

‎packages/panw/data_stream/panos/_dev/test/system/test-udp-config.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
service: panw-panos-udp
2+
service_notify_signal: SIGHUP
3+
input: udp
4+
data_stream:
5+
vars:
6+
syslog_host: 0.0.0.0
7+
syslog_port: 9514

‎packages/panw/data_stream/panos/agent/stream/logfile.yml.hbs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,4 +33,4 @@ processors:
3333
- add_locale: ~
3434
{{#if processors}}
3535
{{processors}}
36-
{{/if}}
36+
{{/if}}

‎packages/panw/data_stream/panos/agent/stream/syslog.yml.hbs‎

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎packages/panw/data_stream/panos/agent/stream/tcp.yml.hbs‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
host: "{{syslog_host}}:{{syslog_port}}"
2+
tags:
3+
{{#if preserve_original_event}}
4+
- preserve_original_event
5+
{{/if}}
6+
{{#each tags as |tag i|}}
7+
- {{tag}}
8+
{{/each}}
9+
{{#contains "forwarded" tags}}
10+
publisher_pipeline.disable_host: true
11+
{{/contains}}
12+
{{#if ssl}}
13+
ssl: {{ssl}}
14+
{{/if}}
15+
processors:
16+
- add_locale: ~
17+
- syslog:
18+
field: message
19+
format: auto
20+
timezone: {{tz_offset}}
21+
{{#if processors}}
22+
{{processors}}
23+
{{/if}}
24+
{{#if internal_zones.length}}
25+
- add_fields:
26+
target: _conf
27+
fields:
28+
internal_zones:
29+
{{#each internal_zones as |zone i|}}
30+
- {{zone}}
31+
{{/each}}
32+
{{/if}}
33+
{{#if external_zones.length}}
34+
- add_fields:
35+
target: _conf
36+
fields:
37+
external_zones:
38+
{{#each external_zones as |zone i|}}
39+
- {{zone}}
40+
{{/each}}
41+
{{/if}}
42+
{{#if tcp_options}}
43+
{{tcp_options}}
44+
{{/if}}

0 commit comments

Comments
 (0)