Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat][Gsuite] Adds Login audit Fileset #19702

Merged
merged 8 commits into from
Jul 14, 2020
Merged

[Filebeat][Gsuite] Adds Login audit Fileset #19702

merged 8 commits into from
Jul 14, 2020

Conversation

marc-gr
Copy link
Contributor

@marc-gr marc-gr commented Jul 7, 2020 •
edited
Loading

What does this PR do?

  • Adds needed pagination changes to Httpjson input to prevent duplicate events
  • Enables Date cursor and Pagination to work together
  • Adds a new fileset that fetches the login audits for GSuite module

Why is it important?

Enhances GSuite module with more meaningful filesets and improves current Gsuite behavior on some edge cases when paginating over records.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jul 7, 2020
@marc-gr marc-gr mentioned this pull request Jul 7, 2020
Merged
6 tasks
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jul 7, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #19702 updated]

  • Start Time: 2020-07-14T17:39:59.901+0000

  • Duration: 88 min 1 sec

Test stats 🧪

Test Results
Failed 0
Passed 4224
Skipped 679
Total 4903

Steps errors

Expand to view the steps failures

  • Name: Report to Codecov

    • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

    • Duration: 2 min 22 sec

    • Start Time: 2020-07-14T18:01:01.728+0000

    • log

@marc-gr marc-gr mentioned this pull request Jul 8, 2020
Merged
6 tasks
@marc-gr marc-gr requested a review from a team July 8, 2020 08:15
@marc-gr marc-gr force-pushed the gsuite_login branch 3 times, most recently from 70d0454 to 0ff5ede Compare July 9, 2020 10:25
andrewkroh
andrewkroh approved these changes Jul 13, 2020
View reviewed changes
Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great. The action values from gsuite are interesting and will be good for setting some alerts.

x-pack/filebeat/module/gsuite/_meta/docs.asciidoc Show resolved Hide resolved
@marc-gr marc-gr force-pushed the gsuite_login branch 6 times, most recently from 4c171be to 1528728 Compare July 14, 2020 06:53
@marc-gr marc-gr merged commit 1487527 into elastic:master Jul 14, 2020
@marc-gr marc-gr deleted the gsuite_login branch July 14, 2020 19:14
marc-gr added a commit to marc-gr/beats that referenced this pull request Jul 15, 2020
@marc-gr
[Filebeat][Gsuite] Adds Login audit Fileset (elastic#19702)
0b6dfe7 
* Extend Pagination and be able to combine with cursor

* Change modules config to use new pagination

* Add Gsuite login fileset

* Update docs

* Add CHANGELOG entry

* Update config

* Add login to config example in docs

* Set interval to 2h

(cherry picked from commit 1487527)
@marc-gr marc-gr mentioned this pull request Jul 15, 2020
Merged
6 tasks
andrewkroh pushed a commit that referenced this pull request Jul 15, 2020
@marc-gr
[Filebeat][Gsuite] Adds Login audit Fileset (#19702) (#19927)
10dc0c5 
* Extend Pagination and be able to combine with cursor

* Change modules config to use new pagination

* Add Gsuite login fileset

* Update docs

* Add CHANGELOG entry

* Update config

* Add login to config example in docs

* Set interval to 2h

(cherry picked from commit 1487527)
This was referenced Jul 15, 2020
Merged
Merged
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
@marc-gr @melchiormoulin
[Filebeat][Gsuite] Adds Login audit Fileset (elastic#19702)
bb8e339 
* Extend Pagination and be able to combine with cursor

* Change modules config to use new pagination

* Add Gsuite login fileset

* Update docs

* Add CHANGELOG entry

* Update config

* Add login to config example in docs

* Set interval to 2h
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees
No one assigned
Labels
enhancement review v7.9.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@marc-gr @elasticmachine @andrewkroh