Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] fortinet.firewall.addr is not always an IP address #25608

Merged
merged 3 commits into from
May 10, 2021
Merged

[Filebeat] fortinet.firewall.addr is not always an IP address #25608

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e3fc488
25585: `fortinet.firewall.addr` is not always an IP address
legoguy1000 May 7, 2021
f72a3cc
update sample logs
legoguy1000 May 7, 2021
71a38f2
fixed pipeline
legoguy1000 May 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -397,6 +397,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Fix Nginx module pipelines. {issue}19088[19088] {pull}24699[24699]
- Remove space from field `sophos.xg.trans_src_ ip`. {issue}25154[25154] {pull}25250[25250]
- Fix `checkpoint.action_reason` when its a string, not a Long. {issue}25575[25575] {pull}25609[25609]
- Fix `fortinet.firewall.addr` when its a string, not an IP address. {issue}25585[25585] {pull}25608[25608]

*Heartbeat*

Expand Down
5 changes: 5 additions & 0 deletions x-pack/filebeat/module/fortinet/firewall/ingest/event.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,11 @@ processors:
field: fortinet.firewall.logdesc
target_field: rule.description
ignore_missing: true
- rename:
field: fortinet.firewall.addr
target_field: fortinet.firewall.addrgrp
if: ctx.rule?.description == 'Dynamic address updated'
ignore_missing: true
- rename:
field: fortinet.firewall.url
target_field: url.path
Expand Down
8 changes: 8 additions & 0 deletions x-pack/filebeat/module/fortinet/firewall/test/fortinet.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,3 +30,11 @@
<189>date=2020-04-23 time=12:14:28 devname="firewall3" devid="oldfwid" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" eventtime=1587230069291463928 tz="-0500" srcip=192.168.50.50 srcport=56603 srcintf="port1" srcintfrole="lan" dstip=8.8.8.8 dstport=442 dstintf="wan1" dstintfrole="wan" sessionid=2345 proto=6 action="close" policyid=2365 policytype="policy" poluuid="654644c-b064-fdgdf3425-f003-1234ghdf682e05f" policyname="someoldpolicyname" user="elasticuser" group="testgroup" authserver="FSSO_something" service="HTTPS" dstcountry="Netherlands" srccountry="Reserved" trandisp="snat" transip=23.23.23.23 transport=603 appid=43540 app="Skype.Portals" appcat="Collaboration" apprisk="elevated" applist="someapplist" appact="detected" duration=126 sentbyte=923 rcvdbyte=77654 sentpkt=113 rcvdpkt=70 vwlid=4 vwlquality="Seq_num(3), alive, selected" wanin=1130 wanout=6671 lanin=1406 lanout=146506 utmaction="block" countweb=1 countapp=1 crscore=5 craction=6144 crlevel="low"
<190>date=2019-05-15 time=18:03:36 logid="1059028704" type="utm" subtype="app-ctrl" eventtype="app-ctrl-all" level="information" vd="root" eventtime=1557968615 appid=40568 srcip=10.1.100.22 dstip=195.8.215.136 srcport=50798 dstport=443 srcintf="port10" srcintfrole="lan" dstintf="port9" dstintfrole="wan" proto=6 service="HTTPS" direction="outgoing" policyid=1 sessionid=4414 applist="block-social.media" appcat="Web.Client" app="HTTPS.BROWSER" action="pass" hostname="www.dailymotion.com" incidentserialno=1962906680 url="/" msg="Web.Client: HTTPS.BROWSER," apprisk="medium" scertcname="*.dailymotion.com" scertissuer="DigiCert SHA2 High Assurance Server CA"
<190>date=2020-11-02 time=08:11:38 devname=testfirewall devid=newrouterid logid=0101037127 type="event" subtype=vpn level=notice vd=root logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action=negotiate remip=8.8.8.8 locip=10.10.10.10 remport=500 locport=500 outintf="port1" cookies="125cbf9ee8349965/0000000000000000" user="N/A" group="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="P1_Test" status=success init=local mode=aggressive dir=outbound stage=1 role=initiator result=OK
<190>devname="firewall" devid="FG201EEF34CD12AB" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674880370858 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="FCTEMS0000011111" addr="FCTEMS0000011111_AV-Running" msg="Updated tag FCTEMS0000011111_AV-Running."
<190>devname="firewall" devid="FG201EEF34CD12AB" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674880455433 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="FCTEMS0000011111" addr="MAC_FCTEMS0000011111_AV-Running" msg="Updated tag MAC_FCTEMS0000011111_AV-Running."
<190>devname="firewall" devid="FG201EEF34CD12AB" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674880744919 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="FCTEMS0000011111" addr="FCTEMS0000011111_Connected-to-EMS" msg="Updated tag FCTEMS0000011111_Connected-to-EMS."
<190>devname="firewall" devid="FG201EEF34CD12AB" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674880784143 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="FCTEMS0000011111" addr="MAC_FCTEMS0000011111_Connected-to-EMS" msg="Updated tag MAC_FCTEMS0000011111_Connected-to-EMS."
<190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900027938 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="FCTEMS0000011111_AV-Running" msg="Updated tag FCTEMS0000011111_AV-Running."
<190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900167367 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="MAC_FCTEMS0000011111_AV-Running" msg="Updated tag MAC_FCTEMS0000011111_AV-Running."
<190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900749585 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="FCTEMS0000011111_Connected-to-EMS" msg="Updated tag FCTEMS0000011111_Connected-to-EMS."
<190>devname="firewall" devid="FG201EAB12CD34EF" vd="root" date=2021-05-07 time=08:31:14 eventtime=1620372674900961834 tz="+0100" logid="0112053203" type="event" subtype="connector" level="information" logdesc="Dynamic address updated" fctemssn="(null)" addr="MAC_FCTEMS0000011111_Connected-to-EMS" msg="Updated tag MAC_FCTEMS0000011111_Connected-to-EMS."
240 changes: 240 additions & 0 deletions x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2030,5 +2030,245 @@
"fortinet-firewall",
"forwarded"
]
},
{
"@timestamp": "2021-05-07T08:31:14.000+01:00",
"event.code": "0112053203",
"event.dataset": "fortinet.firewall",
"event.kind": "event",
"event.module": "fortinet",
"event.start": "2021-05-07T08:31:14.880+01:00",
"event.timezone": "+0100",
"fileset.name": "firewall",
"fortinet.firewall.addrgrp": "FCTEMS0000011111_AV-Running",
"fortinet.firewall.fctemssn": "FCTEMS0000011111",
"fortinet.firewall.subtype": "connector",
"fortinet.firewall.type": "event",
"fortinet.firewall.vd": "root",
"input.type": "log",
"log.level": "information",
"log.offset": 17632,
"message": "Updated tag FCTEMS0000011111_AV-Running.",
"observer.name": "firewall",
"observer.product": "Fortigate",
"observer.serial_number": "FG201EEF34CD12AB",
"observer.type": "firewall",
"observer.vendor": "Fortinet",
"rule.description": "Dynamic address updated",
"service.type": "fortinet",
"tags": [
"fortinet-firewall",
"forwarded"
]
},
{
"@timestamp": "2021-05-07T08:31:14.000+01:00",
"event.code": "0112053203",
"event.dataset": "fortinet.firewall",
"event.kind": "event",
"event.module": "fortinet",
"event.start": "2021-05-07T08:31:14.880+01:00",
"event.timezone": "+0100",
"fileset.name": "firewall",
"fortinet.firewall.addrgrp": "MAC_FCTEMS0000011111_AV-Running",
"fortinet.firewall.fctemssn": "FCTEMS0000011111",
"fortinet.firewall.subtype": "connector",
"fortinet.firewall.type": "event",
"fortinet.firewall.vd": "root",
"input.type": "log",
"log.level": "information",
"log.offset": 17978,
"message": "Updated tag MAC_FCTEMS0000011111_AV-Running.",
"observer.name": "firewall",
"observer.product": "Fortigate",
"observer.serial_number": "FG201EEF34CD12AB",
"observer.type": "firewall",
"observer.vendor": "Fortinet",
"rule.description": "Dynamic address updated",
"service.type": "fortinet",
"tags": [
"fortinet-firewall",
"forwarded"
]
},
{
"@timestamp": "2021-05-07T08:31:14.000+01:00",
"event.code": "0112053203",
"event.dataset": "fortinet.firewall",
"event.kind": "event",
"event.module": "fortinet",
"event.start": "2021-05-07T08:31:14.880+01:00",
"event.timezone": "+0100",
"fileset.name": "firewall",
"fortinet.firewall.addrgrp": "FCTEMS0000011111_Connected-to-EMS",
"fortinet.firewall.fctemssn": "FCTEMS0000011111",
"fortinet.firewall.subtype": "connector",
"fortinet.firewall.type": "event",
"fortinet.firewall.vd": "root",
"input.type": "log",
"log.level": "information",
"log.offset": 18332,
"message": "Updated tag FCTEMS0000011111_Connected-to-EMS.",
"observer.name": "firewall",
"observer.product": "Fortigate",
"observer.serial_number": "FG201EEF34CD12AB",
"observer.type": "firewall",
"observer.vendor": "Fortinet",
"rule.description": "Dynamic address updated",
"service.type": "fortinet",
"tags": [
"fortinet-firewall",
"forwarded"
]
},
{
"@timestamp": "2021-05-07T08:31:14.000+01:00",
"event.code": "0112053203",
"event.dataset": "fortinet.firewall",
"event.kind": "event",
"event.module": "fortinet",
"event.start": "2021-05-07T08:31:14.880+01:00",
"event.timezone": "+0100",
"fileset.name": "firewall",
"fortinet.firewall.addrgrp": "MAC_FCTEMS0000011111_Connected-to-EMS",
"fortinet.firewall.fctemssn": "FCTEMS0000011111",
"fortinet.firewall.subtype": "connector",
"fortinet.firewall.type": "event",
"fortinet.firewall.vd": "root",
"input.type": "log",
"log.level": "information",
"log.offset": 18690,
"message": "Updated tag MAC_FCTEMS0000011111_Connected-to-EMS.",
"observer.name": "firewall",
"observer.product": "Fortigate",
"observer.serial_number": "FG201EEF34CD12AB",
"observer.type": "firewall",
"observer.vendor": "Fortinet",
"rule.description": "Dynamic address updated",
"service.type": "fortinet",
"tags": [
"fortinet-firewall",
"forwarded"
]
},
{
"@timestamp": "2021-05-07T08:31:14.000+01:00",
"event.code": "0112053203",
"event.dataset": "fortinet.firewall",
"event.kind": "event",
"event.module": "fortinet",
"event.start": "2021-05-07T08:31:14.900+01:00",
"event.timezone": "+0100",
"fileset.name": "firewall",
"fortinet.firewall.addrgrp": "FCTEMS0000011111_AV-Running",
"fortinet.firewall.fctemssn": "(null)",
"fortinet.firewall.subtype": "connector",
"fortinet.firewall.type": "event",
"fortinet.firewall.vd": "root",
"input.type": "log",
"log.level": "information",
"log.offset": 19056,
"message": "Updated tag FCTEMS0000011111_AV-Running.",
"observer.name": "firewall",
"observer.product": "Fortigate",
"observer.serial_number": "FG201EAB12CD34EF",
"observer.type": "firewall",
"observer.vendor": "Fortinet",
"rule.description": "Dynamic address updated",
"service.type": "fortinet",
"tags": [
"fortinet-firewall",
"forwarded"
]
},
{
"@timestamp": "2021-05-07T08:31:14.000+01:00",
"event.code": "0112053203",
"event.dataset": "fortinet.firewall",
"event.kind": "event",
"event.module": "fortinet",
"event.start": "2021-05-07T08:31:14.900+01:00",
"event.timezone": "+0100",
"fileset.name": "firewall",
"fortinet.firewall.addrgrp": "MAC_FCTEMS0000011111_AV-Running",
"fortinet.firewall.fctemssn": "(null)",
"fortinet.firewall.subtype": "connector",
"fortinet.firewall.type": "event",
"fortinet.firewall.vd": "root",
"input.type": "log",
"log.level": "information",
"log.offset": 19392,
"message": "Updated tag MAC_FCTEMS0000011111_AV-Running.",
"observer.name": "firewall",
"observer.product": "Fortigate",
"observer.serial_number": "FG201EAB12CD34EF",
"observer.type": "firewall",
"observer.vendor": "Fortinet",
"rule.description": "Dynamic address updated",
"service.type": "fortinet",
"tags": [
"fortinet-firewall",
"forwarded"
]
},
{
"@timestamp": "2021-05-07T08:31:14.000+01:00",
"event.code": "0112053203",
"event.dataset": "fortinet.firewall",
"event.kind": "event",
"event.module": "fortinet",
"event.start": "2021-05-07T08:31:14.900+01:00",
"event.timezone": "+0100",
"fileset.name": "firewall",
"fortinet.firewall.addrgrp": "FCTEMS0000011111_Connected-to-EMS",
"fortinet.firewall.fctemssn": "(null)",
"fortinet.firewall.subtype": "connector",
"fortinet.firewall.type": "event",
"fortinet.firewall.vd": "root",
"input.type": "log",
"log.level": "information",
"log.offset": 19736,
"message": "Updated tag FCTEMS0000011111_Connected-to-EMS.",
"observer.name": "firewall",
"observer.product": "Fortigate",
"observer.serial_number": "FG201EAB12CD34EF",
"observer.type": "firewall",
"observer.vendor": "Fortinet",
"rule.description": "Dynamic address updated",
"service.type": "fortinet",
"tags": [
"fortinet-firewall",
"forwarded"
]
},
{
"@timestamp": "2021-05-07T08:31:14.000+01:00",
"event.code": "0112053203",
"event.dataset": "fortinet.firewall",
"event.kind": "event",
"event.module": "fortinet",
"event.start": "2021-05-07T08:31:14.900+01:00",
"event.timezone": "+0100",
"fileset.name": "firewall",
"fortinet.firewall.addrgrp": "MAC_FCTEMS0000011111_Connected-to-EMS",
"fortinet.firewall.fctemssn": "(null)",
"fortinet.firewall.subtype": "connector",
"fortinet.firewall.type": "event",
"fortinet.firewall.vd": "root",
"input.type": "log",
"log.level": "information",
"log.offset": 20084,
"message": "Updated tag MAC_FCTEMS0000011111_Connected-to-EMS.",
"observer.name": "firewall",
"observer.product": "Fortigate",
"observer.serial_number": "FG201EAB12CD34EF",
"observer.type": "firewall",
"observer.vendor": "Fortinet",
"rule.description": "Dynamic address updated",
"service.type": "fortinet",
"tags": [
"fortinet-firewall",
"forwarded"
]
}
]