Skip to content

[ECS] Updating okta to ECS 8.10 & ECS field validation updates #7930

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Sep 22, 2023
Merged

[ECS] Updating okta to ECS 8.10 & ECS field validation updates #7930

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
09484f6
Correcting ecs field validation & updating to ecs 8.10
kgeller Sep 22, 2023
a9472f0
Update changelog.yml
kgeller Sep 22, 2023
5256f66
bumping min stack version per https://discuss.elastic.co/t/kibana-8-1…
kgeller Sep 22, 2023
131102a
regenerated sample event
kgeller Sep 22, 2023
53890eb
rebuilding docs
kgeller Sep 22, 2023
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/okta/_dev/build/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
dependencies:
ecs:
reference: git@v8.9.0
reference: git@v8.10.0
5 changes: 5 additions & 0 deletions packages/okta/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.1.0"
changes:
- description: Update package to ECS 8.10.0, align ECS categorization fields, and updated stack version to ^8.10.1 per security fix.
type: enhancement
link: https://github.com/elastic/integrations/pull/7930
- version: "2.0.0"
changes:
- description: Added Okta Oauth2 support, refactored the UI accordingly & updated stack version to ^8.10.0.
Expand Down
70 changes: 35 additions & 35 deletions ...ages/okta/data_stream/system/_dev/test/pipeline/test-okta-system-events.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.end",
Expand All @@ -34,7 +34,7 @@
"outcome": "success",
"type": [
"end",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -172,7 +172,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.start",
Expand All @@ -186,7 +186,7 @@
"outcome": "success",
"type": [
"start",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -324,7 +324,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "policy.evaluate_sign_on",
Expand Down Expand Up @@ -489,7 +489,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.end",
Expand All @@ -503,7 +503,7 @@
"outcome": "success",
"type": [
"end",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -641,7 +641,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.start",
Expand All @@ -655,7 +655,7 @@
"outcome": "success",
"type": [
"start",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -793,7 +793,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "policy.evaluate_sign_on",
Expand Down Expand Up @@ -958,7 +958,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.end",
Expand All @@ -972,7 +972,7 @@
"outcome": "success",
"type": [
"end",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -1109,7 +1109,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.start",
Expand All @@ -1123,7 +1123,7 @@
"outcome": "success",
"type": [
"start",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -1261,7 +1261,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "policy.evaluate_sign_on",
Expand Down Expand Up @@ -1425,7 +1425,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.end",
Expand All @@ -1439,7 +1439,7 @@
"outcome": "success",
"type": [
"end",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -1558,7 +1558,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.start",
Expand All @@ -1572,7 +1572,7 @@
"outcome": "success",
"type": [
"start",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -1692,7 +1692,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "policy.evaluate_sign_on",
Expand Down Expand Up @@ -1846,7 +1846,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.session.start",
Expand All @@ -1860,7 +1860,7 @@
"outcome": "success",
"type": [
"start",
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -2035,7 +2035,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.authentication.verify",
Expand Down Expand Up @@ -2210,7 +2210,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.authentication.verify",
Expand Down Expand Up @@ -2391,7 +2391,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.authentication.auth_via_mfa",
Expand Down Expand Up @@ -2569,7 +2569,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.authentication.auth_via_mfa",
Expand Down Expand Up @@ -2755,7 +2755,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.authentication.auth_via_mfa",
Expand Down Expand Up @@ -2952,7 +2952,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "group.user_membership.add",
Expand Down Expand Up @@ -3115,7 +3115,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "app.user_management",
Expand Down Expand Up @@ -3214,7 +3214,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.authentication.sso",
Expand All @@ -3226,7 +3226,7 @@
"original": "{\"actor\":{\"alternateId\":\"test.user@test.com\",\"detailEntry\":null,\"displayName\":\"Test User\",\"id\":\"00uk123456abct7\",\"type\":\"User\"},\"authenticationContext\":{\"authenticationProvider\":null,\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":null,\"externalSessionId\":\"idxabcdefg123zA\",\"interface\":null,\"issuer\":null},\"client\":{},\"debugContext\":{},\"device\":{\"device_integrator\":null,\"disk_encryption_type\":\"ALL_INTERNAL_VOLUMES\",\"id\":\"abcdefghijklmnop\",\"jailbreak\":null,\"managed\":false,\"name\":\"MacBookPro14,2\",\"os_platform\":\"OSX\",\"os_version\":\"12.6.6\",\"registered\":true,\"screen_lock_type\":\"PASSCODE\",\"secure_hardware_present\":true},\"displayMessage\":\"User single sign on to app\",\"eventType\":\"user.authentication.sso\",\"legacyEventType\":\"app.auth.sso\",\"outcome\":{\"reason\":null,\"result\":\"SUCCESS\"},\"published\":\"2023-05-23T19:39:49.513Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Lawn Park\",\"country\":\"United States\",\"geolocation\":{\"lat\":47.8907,\"lon\":-87.7908},\"postalCode\":\"999999\",\"state\":\"California\"},\"ip\":\"192.168.1.10\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":7018,\"asOrg\":\"at\u0026t corp.\",\"domain\":\"sbcglobal.net\",\"isProxy\":false,\"isp\":\"att services inc\"},\"severity\":\"INFO\",\"target\":[{\"alternateId\":\"Wiki\",\"detailEntry\":{\"signOnModeType\":\"SAML_2_0\"},\"displayName\":\"An App Server\",\"id\":\"0o123456abcdef1t7\",\"type\":\"AppInstance\"},{\"alternateId\":\"test.user@test.com\",\"detailEntry\":null,\"displayName\":\"Test User\",\"id\":\"0ustyhdhurhjtdrhh1t7\",\"type\":\"AppUser\"}],\"transaction\":{\"detail\":{},\"id\":\"ZGmw\",\"type\":\"WEB\"},\"uuid\":\"2D6FC3CC-3BFB-4AC1-8259-016CF6A5976C\",\"version\":\"0\"}",
"outcome": "success",
"type": [
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -3343,7 +3343,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.authentication.sso",
Expand All @@ -3355,7 +3355,7 @@
"original": "{\"actor\":{\"alternateId\":\"test.user@test.com\",\"detailEntry\":null,\"displayName\":\"Test User\",\"id\":\"00uk123456abct7\",\"type\":\"User\"},\"authenticationContext\":{\"authenticationProvider\":null,\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":null,\"externalSessionId\":\"idxabcdefg123zA\",\"interface\":null,\"issuer\":null},\"client\":{},\"debugContext\":{},\"device\":{\"device_integrator\":\"{\\\"WSC\\\":{},\\\"CROWDSTRIKE\\\":{}}\",\"disk_encryption_type\":\"ALL_INTERNAL_VOLUMES\",\"id\":\"V9YPwc5tnhWcaLs3\",\"jailbreak\":null,\"managed\":false,\"name\":\"MacBookPro18,2\",\"os_platform\":\"OSX\",\"os_version\":\"13.3.1\",\"registered\":true,\"screen_lock_type\":\"BIOMETRIC\",\"secure_hardware_present\":true},\"displayMessage\":\"User single sign on to app\",\"eventType\":\"user.authentication.sso\",\"legacyEventType\":\"app.auth.sso\",\"outcome\":{\"reason\":null,\"result\":\"SUCCESS\"},\"published\":\"2023-05-23T19:39:49.513Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Lawn Park\",\"country\":\"United States\",\"geolocation\":{\"lat\":47.8907,\"lon\":-87.7908},\"postalCode\":\"999999\",\"state\":\"California\"},\"ip\":\"192.168.1.10\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":7018,\"asOrg\":\"at\u0026t corp.\",\"domain\":\"sbcglobal.net\",\"isProxy\":false,\"isp\":\"att services inc\"},\"severity\":\"INFO\",\"target\":[{\"alternateId\":\"Wiki\",\"detailEntry\":{\"signOnModeType\":\"SAML_2_0\"},\"displayName\":\"An App Server\",\"id\":\"0o123456abcdef1t7\",\"type\":\"AppInstance\"},{\"alternateId\":\"test.user@test.com\",\"detailEntry\":null,\"displayName\":\"Test User\",\"id\":\"0ustyhdhurhjtdrhh1t7\",\"type\":\"AppUser\"}],\"transaction\":{\"detail\":{},\"id\":\"ZGmw\",\"type\":\"WEB\"},\"uuid\":\"2D6FC3CC-3BFB-4AC1-8259-016CF6A5976C\",\"version\":\"0\"}",
"outcome": "success",
"type": [
"user"
"info"
]
},
"okta": {
Expand Down Expand Up @@ -3486,7 +3486,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "user.authentication.auth_via_mfa",
Expand Down Expand Up @@ -3655,7 +3655,7 @@
}
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"event": {
"action": "device.user.add",
Expand Down
4 changes: 2 additions & 2 deletions packages/okta/data_stream/system/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ description: Pipeline for Okta system logs.
processors:
- set:
field: ecs.version
value: '8.9.0'
value: '8.10.0'
# Keep message as event.original.
# Warn if event.original has already been set. This is most likely due to logstash ecs_compatibility setting.
- append:
Expand Down Expand Up @@ -116,7 +116,7 @@ processors:
if: '["group.user_membership.add","group.user_membership.remove"].contains(ctx?.okta?.event_type)'
- append:
field: event.type
value: user
value: info
if: |
["user.lifecycle.activate","user.lifecycle.create",
"user.lifecycle.deactivate","user.lifecycle.suspend",
Expand Down
18 changes: 9 additions & 9 deletions packages/okta/data_stream/system/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
{
"@timestamp": "2020-02-14T20:18:57.718Z",
"agent": {
"ephemeral_id": "3f42021e-4a96-4f9e-a171-f1270261873e",
"id": "12fae7e9-e1d1-4d7d-935d-77da8e90f576",
"ephemeral_id": "3b6c86fa-7cc1-4bd2-8064-b2f3c8c38bef",
"id": "f25d13cd-18cc-4e73-822c-c4f849322623",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.9.0"
"version": "8.10.1"
},
"client": {
"geo": {
Expand All @@ -30,12 +30,12 @@
"type": "logs"
},
"ecs": {
"version": "8.9.0"
"version": "8.10.0"
},
"elastic_agent": {
"id": "12fae7e9-e1d1-4d7d-935d-77da8e90f576",
"id": "f25d13cd-18cc-4e73-822c-c4f849322623",
"snapshot": false,
"version": "8.9.0"
"version": "8.10.1"
},
"event": {
"action": "user.session.start",
Expand All @@ -44,16 +44,16 @@
"authentication",
"session"
],
"created": "2023-08-09T18:07:16.315Z",
"created": "2023-09-22T17:12:24.505Z",
"dataset": "okta.system",
"id": "3aeede38-4f67-11ea-abd3-1f5d113f2546",
"ingested": "2023-08-09T18:07:17Z",
"ingested": "2023-09-22T17:12:25Z",
"kind": "event",
"original": "{\"actor\":{\"alternateId\":\"xxxxxx@elastic.co\",\"detailEntry\":null,\"displayName\":\"xxxxxx\",\"id\":\"00u1abvz4pYqdM8ms4x6\",\"type\":\"User\"},\"authenticationContext\":{\"authenticationProvider\":null,\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":null,\"externalSessionId\":\"102bZDNFfWaQSyEZQuDgWt-uQ\",\"interface\":null,\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"108.255.197.247\",\"userAgent\":{\"browser\":\"FIREFOX\",\"os\":\"Mac OS X\",\"rawUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"deviceFingerprint\":\"541daf91d15bef64a7e08c946fd9a9d0\",\"requestId\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"requestUri\":\"/api/v1/authn\",\"threatSuspected\":\"false\",\"url\":\"/api/v1/authn?\"}},\"displayMessage\":\"User login to Okta\",\"eventType\":\"user.session.start\",\"legacyEventType\":\"core.user_auth.login_success\",\"outcome\":{\"reason\":null,\"result\":\"SUCCESS\"},\"published\":\"2020-02-14T20:18:57.718Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"ip\":\"108.255.197.247\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":null,\"asOrg\":null,\"domain\":null,\"isProxy\":null,\"isp\":null},\"severity\":\"INFO\",\"target\":null,\"transaction\":{\"detail\":{},\"id\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"type\":\"WEB\"},\"uuid\":\"3aeede38-4f67-11ea-abd3-1f5d113f2546\",\"version\":\"0\"}",
"outcome": "success",
"type": [
"start",
"user"
"info"
]
},
"input": {
Expand Down
Loading