[cisco_asa] Extract specific fields from message ids 717022, 751025 #14150
Conversation
jrmolin added Integration:cisco_asa 
| Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
| description: >- | ||
| Sets the parts to the correct names | ||
| params: | ||
| "ST": | ||
| name: "state_or_province" | ||
| "S": | ||
| name: "state_or_province" | ||
| "P": | ||
| name: "state_or_province" | ||
| "CN": | ||
| name: "common_name" | ||
| "C": | ||
| name: "country" | ||
| "L": | ||
| name: "locality" | ||
| "O": | ||
| name: "organization" | ||
| "OU": | ||
| name: "organizational_unit" | ||
| source: | | ||
| def subject = new HashMap(); | ||
| def parts = ctx._temp_.cisco.dn_parts; | ||
| for (entry in params.entrySet()) { | ||
| def k = entry.getKey(); | ||
| def _v = entry.getValue(); | ||
| if (parts.containsKey(k)) { | ||
| def v = parts[k]; | ||
| List values = (v instanceof List) ? v : [v]; // `[v]` is a Painless list literal | ||
| subject[_v["name"]] = values; | ||
| } | ||
| } | ||
| ctx._temp_.cisco.dn_parts = subject; | ||
| if: 'ctx._temp_.cisco?.dn_parts != null' |
There was a problem hiding this comment.
Seems like this can be simplified.
| description: >- | |
| Sets the parts to the correct names | |
| params: | |
| "ST": | |
| name: "state_or_province" | |
| "S": | |
| name: "state_or_province" | |
| "P": | |
| name: "state_or_province" | |
| "CN": | |
| name: "common_name" | |
| "C": | |
| name: "country" | |
| "L": | |
| name: "locality" | |
| "O": | |
| name: "organization" | |
| "OU": | |
| name: "organizational_unit" | |
| source: | | |
| def subject = new HashMap(); | |
| def parts = ctx._temp_.cisco.dn_parts; | |
| for (entry in params.entrySet()) { | |
| def k = entry.getKey(); | |
| def _v = entry.getValue(); | |
| if (parts.containsKey(k)) { | |
| def v = parts[k]; | |
| List values = (v instanceof List) ? v : [v]; // `[v]` is a Painless list literal | |
| subject[_v["name"]] = values; | |
| } | |
| } | |
| ctx._temp_.cisco.dn_parts = subject; | |
| if: 'ctx._temp_.cisco?.dn_parts != null' | |
| tag: script_distinguished_name_parts | |
| description: >- | |
| Sets the parts to the correct names | |
| params: | |
| "ST": "state_or_province" | |
| "S": "state_or_province" | |
| "P": "state_or_province" | |
| "CN": "common_name" | |
| "C": "country" | |
| "L": "locality" | |
| "O": "organization" | |
| "OU": "organizational_unit" | |
| source: | | |
| if (ctx._temp_?.cisco?.dn_parts == null) { | |
| return; | |
| } | |
| def parts = [:]; | |
| ctx._temp_.cisco.dn_parts.forEach((k, v) -> { if (params.containsKey(k)) { parts[params[k]] = v; } else return false; }); | |
| ctx._temp_.cisco.dn_parts = parts; |
There was a problem hiding this comment.
yeah, i was doing other things at first. simplifying is good.
| } | ||
| }); | ||
| ctx._temp_.cisco.dn_parts = parts; | ||
| if: 'ctx._temp_.cisco?.dn_parts != null' |
There was a problem hiding this comment.
This line is redundant since the main script already checks for null. (if statements are painless scripts as well, so it's not like the if statement is going to be any faster).
| if: 'ctx._temp_.cisco?.dn_parts != null' |
There was a problem hiding this comment.
oh; i didn't know that about if statements. i thought it would be faster not to spin up an environment, but it definitely isn't. i understand now.
There was a problem hiding this comment.
i made this change yesterday, but somehow forgot to push it after it passed my local testing.
packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml Show resolved Hide resolved
🚀 Benchmarks reportPackage |
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log | 1079.91 | 818.33 | -261.58 (-24.22%) | 💔 |
To see the full report comment with /test benchmark fullreport
|
💚 Build Succeeded
History
|
| Package cisco_asa - 2.43.5 containing this change is available at https://epr.elastic.co/package/cisco_asa/2.43.5/ |
andrewkroh added the documentation 6 participants
Proposed commit message
[cisco_asa] Add specific parsing for 717022, 751025
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots