[cisco_meraki] Parse of connecting and reconnecting events

[brijesh-elastic]

Proposed commit message

cisco_meraki: Fix the parsing of connecting and reconnecting events for anyconnect_vpn_connect and client_vpn_connect. 

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/cisco_meraki directory.
• Run the following command to run tests.

elastic-package test

Related issues

• Related https://github.com/elastic/enhancements/issues/24810

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package cisco_meraki 👍(0) 💚(1) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
events	500000	333333.33	-166666.67 (-33.33%)	💔

To see the full report comment with /test benchmark fullreport

[kcreddy]

/test

[kcreddy]

@brijesh-elastic, this doesn't seem to be an issue with CI. I was able to get similar output as CI locally. Please check.

diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json index 95c5c74b29..d36643f01f 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json @@ -553,12 +553,20 @@ "observer": { "hostname": "MX_device_4" }, + "related": { + "user": [ + "user", + "user@example.com" + ] + }, "tags": [ "forwarded", "preserve_original_event" ], "user": { - "name": "user@example.com" + "domain": "example.com", + "email": "user@example.com", + "name": "user" } }, { @@ -1728,6 +1736,11 @@ "observer": { "hostname": "TCP9001" }, + "related": { + "user": [ + "user.name3" + ] + }, "tags": [ "forwarded", "preserve_original_event" diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json index c6e3ec0610..b42049f515 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json @@ -228,7 +228,7 @@ "name": "Windows", "version": "10" }, - "version": "108.0" + "version": "108.0." } }, {

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 579e558

History

• 💔 Build #27335 failed 716535a
• 💔 Build #27314 failed 716535a
• 💚 Build #27293 succeeded 74813cf

cc @brijesh-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[efd6]

This is a stack version issue; it's important to run the test expectation generation with the same stack version as is specified by the package's manifest kibana.version.

[brijesh-elastic]

This is a stack version issue; it's important to run the test expectation generation with the same stack version as is specified by the package's manifest kibana.version.

Thanks @efd6, Resolved in 579e558

[efd6]

Why do the event.types (and event.categorys) differ between the client_vpn_connect and the anyconnect_vpn_connect cases?

[brijesh-elastic]

by default, we're adding network in event.category and info in event.type (see here)
and for client_vpn_connect subtype, event categorization is performed again here.

[efd6]

Probably worth a follow-up issue. Not for now.

[brijesh-elastic]

sure.

[efd6]

Thanks

[elastic-vault-github-plugin-prod]

Package cisco_meraki - 1.29.1 containing this change is available at https://epr.elastic.co/package/cisco_meraki/1.29.1/