forked from elastic/beats
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Filebeat][Gsuite] Adds Groups audit Fileset (elastic#19725)
* Add support for Gsuite groups fileset * Add CHANGELOG entry * Update config * Regenerate test files
- Loading branch information
Showing
14 changed files
with
1,844 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| - name: groups | ||
| type: group | ||
| fields: | ||
| - name: acl_permission | ||
| type: keyword | ||
| description: > | ||
| Group permission setting updated. | ||
| For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups | ||
| - name: email | ||
| type: keyword | ||
| description: > | ||
| Group email. | ||
| - name: member.email | ||
| type: keyword | ||
| description: > | ||
| Member email. | ||
| - name: member.role | ||
| type: keyword | ||
| description: > | ||
| Member role. | ||
| For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups | ||
| - name: setting | ||
| type: keyword | ||
| description: > | ||
| Group setting updated. | ||
| For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups | ||
| - name: new_value | ||
| type: keyword | ||
| description: > | ||
| New value(s) of the group setting. | ||
| For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups | ||
| - name: old_value | ||
| type: keyword | ||
| description: | ||
| Old value(s) of the group setting. | ||
| For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups | ||
| - name: value | ||
| type: keyword | ||
| description: > | ||
| Value of the group setting. | ||
| For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups | ||
| - name: message.id | ||
| type: keyword | ||
| description: > | ||
| SMTP message Id of an email message. | ||
| Present for moderation events. | ||
| - name: message.moderation_action | ||
| type: keyword | ||
| description: > | ||
| Message moderation action. | ||
| Possible values are `approved` and `rejected`. | ||
| - name: status | ||
| type: keyword | ||
| description: > | ||
| A status describing the output of an operation. | ||
| Possible values are `failed` and `succeeded`. | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| {{ if eq .input "httpjson" }} | ||
| type: httpjson | ||
|
|
||
| url: https://www.googleapis.com/admin/reports/v1/activity/users/{{ .user_key }}/applications/groups | ||
| json_objects_array: items | ||
| split_events_by: events | ||
|
|
||
| interval: {{ .interval }} | ||
|
|
||
| {{ if .http_client_timeout }} | ||
| http_client_timeout: {{ .http_client_timeout }} | ||
| {{ end }} | ||
|
|
||
| oauth2.provider: google | ||
| oauth2.google.jwt_file: {{ .jwt_file }} | ||
| oauth2.google.delegated_account: {{ .delegated_account }} | ||
| oauth2.scopes: | ||
| - https://www.googleapis.com/auth/admin.reports.audit.readonly | ||
|
|
||
| date_cursor.url_field: startTime | ||
| date_cursor.initial_interval: {{ .initial_interval }} | ||
|
|
||
| pagination.id_field: nextPageToken | ||
| pagination.url_field: pageToken | ||
|
|
||
| {{ else if eq .input "file" }} | ||
| type: log | ||
| paths: | ||
| {{ range $i, $path := .paths }} | ||
| - {{$path}} | ||
| {{ end }} | ||
| exclude_files: [".gz$"] | ||
| {{ end }} | ||
|
|
||
| tags: {{.tags | tojson}} | ||
| publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} | ||
|
|
||
| processors: | ||
| - add_fields: | ||
| target: '' | ||
| fields: | ||
| ecs.version: 1.5.0 | ||
| - script: | ||
| lang: javascript | ||
| id: gsuite-common | ||
| file: ${path.home}/module/gsuite/config/common.js | ||
| - script: | ||
| lang: javascript | ||
| id: gsuite-groups | ||
| file: ${path.home}/module/gsuite/groups/config/pipeline.js |
Oops, something went wrong.