fortinet_fortigate: fix handling of events with from fields

packages/fortinet_fortigate/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.0.1"
+ changes:
+ - description: Fix handling of sip events.
+ type: bugfix
+ link: https://github.com/elastic/integrations/pull/3901
 - version: "1.0.0"
  changes:
  - description: Initial version of Fortinet FortiGate as separate package

packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet.log

@@ -37,4 +37,5 @@
 <190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900027938 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="FCTEMS0000011111_AV-Running" msg="Updated tag FCTEMS0000011111_AV-Running."
 <190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900167367 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="MAC_FCTEMS0000011111_AV-Running" msg="Updated tag MAC_FCTEMS0000011111_AV-Running."
 <190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900749585 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="FCTEMS0000011111_Connected-to-EMS" msg="Updated tag FCTEMS0000011111_Connected-to-EMS."
-<190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900961834 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="MAC_FCTEMS0000011111_Connected-to-EMS" msg="Updated tag MAC_FCTEMS0000011111_Connected-to-EMS."
+<190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900961834 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="MAC_FCTEMS0000011111_Connected-to-EMS" msg="Updated tag MAC_FCTEMS0000011111_Connected-to-EMS."
+<190>date=2022-07-29 time=14:17:14 devname="FGT-Principal" devid="XXXXXXXX" eventtime=1659097034396946116 tz="+0200" logid="0814044032" type="utm" subtype="voip" eventtype="voip" level="information" vd="VDOMX" session_id=285812576 epoch=0 event_id=6939 srcip=10.1.1.2 src_port=57904 dstip=192.168.1.10 dst_port=5060 proto=6 src_int="Int1" dst_int="Int2" policy_id=314 profile="default" voip_proto="sip" kind="register" action="permit" status="succeeded" duration=0 dir="session_origin" call_id="9c7bef42-54490003-00000cd0-00004a9b@10.1.1.2" from="sip:4537@192.168.1.10" to="sip:4537@192.168.1.10"

packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet.log-expected.json

@@ -3230,6 +3230,95 @@
  "tags": [
  "preserve_original_event"
  ]
+ },
+ {
+ "@timestamp": "2022-07-29T14:17:14.000+02:00",
+ "destination": {
+ "ip": "192.168.1.10",
+ "port": 5060
+ },
+ "ecs": {
+ "version": "8.3.0"
+ },
+ "email": {
+ "from": {
+ "address": [
+ "sip:4537@192.168.1.10"
+ ]
+ }
+ },
+ "event": {
+ "action": "voip",
+ "category": [
+ "network"
+ ],
+ "code": "0814044032",
+ "duration": 0,
+ "id": "6939",
+ "kind": "event",
+ "original": "\u003c190\u003edate=2022-07-29 time=14:17:14 devname=\"FGT-Principal\" devid=\"XXXXXXXX\" eventtime=1659097034396946116 tz=\"+0200\" logid=\"0814044032\" type=\"utm\" subtype=\"voip\" eventtype=\"voip\" level=\"information\" vd=\"VDOMX\" session_id=285812576 epoch=0 event_id=6939 srcip=10.1.1.2 src_port=57904 dstip=192.168.1.10 dst_port=5060 proto=6 src_int=\"Int1\" dst_int=\"Int2\" policy_id=314 profile=\"default\" voip_proto=\"sip\" kind=\"register\" action=\"permit\" status=\"succeeded\" duration=0 dir=\"session_origin\" call_id=\"9c7bef42-54490003-00000cd0-00004a9b@10.1.1.2\" from=\"sip:4537@192.168.1.10\" to=\"sip:4537@192.168.1.10\"",
+ "outcome": "success",
+ "start": "2022-07-29T14:17:14.396+02:00",
+ "timezone": "+0200"
+ },
+ "fortinet": {
+ "firewall": {
+ "action": "permit",
+ "call_id": "9c7bef42-54490003-00000cd0-00004a9b@10.1.1.2",
+ "epoch": "0",
+ "from": "sip:4537@192.168.1.10",
+ "kind": "register",
+ "session_id": "285812576",
+ "status": "succeeded",
+ "subtype": "voip",
+ "to": "sip:4537@192.168.1.10",
+ "type": "utm",
+ "vd": "VDOMX",
+ "voip_proto": "sip"
+ }
+ },
+ "log": {
+ "level": "information"
+ },
+ "network": {
+ "direction": "session_origin",
+ "iana_number": "6",
+ "transport": "tcp"
+ },
+ "observer": {
+ "egress": {
+ "interface": {
+ "name": "Int2"
+ }
+ },
+ "ingress": {
+ "interface": {
+ "name": "Int1"
+ }
+ },
+ "name": "FGT-Principal",
+ "product": "Fortigate",
+ "serial_number": "XXXXXXXX",
+ "type": "firewall",
+ "vendor": "Fortinet"
+ },
+ "related": {
+ "ip": [
+ "10.1.1.2",
+ "192.168.1.10"
+ ]
+ },
+ "rule": {
+ "id": "314",
+ "ruleset": "default"
+ },
+ "source": {
+ "ip": "10.1.1.2",
+ "port": 57904
+ },
+ "tags": [
+ "preserve_original_event"
+ ]
  }
  ]
 }

packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/utm.yml

@@ -130,10 +130,6 @@ processors:
  field: email.from.address
  value: "{{fortinet.firewall.from}}"
  if: "ctx?.fortinet?.firewall?.from != null"
- - rename:
- field: fortinet.firewall.from
- target_field: email.from.address
- ignore_missing: true
  - rename:
  field: fortinet.firewall.agent
  target_field: user_agent.original

packages/fortinet_fortigate/manifest.yml

@@ -1,6 +1,6 @@
 name: fortinet_fortigate
 title: Fortinet FortiGate Firewall Logs
-version: 1.0.0
+version: 1.0.1
 release: ga
 description: Collect logs from Fortinet FortiGate firewalls with Elastic Agent.
 type: integration