[Filebeat] Add HIP Match logs to Palo Alto Module #25686

legoguy1000 · 2021-05-12T12:52:57Z

What does this PR do?

Update panw.panos module to parse HIP Match logs. Also this updates the Global Protect parsing with additional fields per the updated docs, https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields.html

Why is it important?

Adds additional log types from Palo Alto

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

[ ]

How to test this PR locally

cd beats/x-pack/filebeat
TESTING_FILEBEAT_MODULES=panw TESTING_FILEBEAT_FILESETS=panos mage -v pythonIntegTest

Related issues

Closes Extend PANW/panos module with globalprotect and hipmatch datasets #24350

Use cases

Screenshots

Logs

elasticmachine · 2021-05-12T13:00:28Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Build Cause: adriansr commented: /test
Start Time: 2021-05-26T07:45:43.717+0000
Duration: 107 min 20 sec
Commit: 2269f05

Test stats 🧪

Test	Results
Failed	0
Passed	13887
Skipped	2292
Total	16179

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	13887
Skipped	2292
Total	16179

elasticmachine · 2021-05-12T18:36:04Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

adriansr · 2021-05-12T18:36:50Z

/test

adriansr · 2021-05-12T18:57:03Z

Found two more HIPMATCH samples, not a lot of those around:

Oct 09 10:20:15 SumoRedfw01a.sumotest.com 1,2019/10/09 10:20:15,001234567890002,HIPMATCH,0,2304,2019/10/09 10:20:15,ira,vsys1,oh-C02ABCDEFGH4,Mac,67.240.185.235,GP-HIP-PROFILE,1,profile,0,0,0123456789,0x0,0,0,0,0,,SumoRedfw01a,1,0.0.0.0,gh:85:90:99:5a:40,C02ABCDEFGH
Apr 4 22:23:52 panorama.domain 1,2018/04/04 22:23:52,FirewallSerialNumber,749593939,0x8000000000000000,HIPMATCH,0,508,2018/04/04 22:23:50,19,398,0,0,,firewall.name,1,domain\user,vsys1,hostname,8.8.8.8,HIP-PROFILE-RULE,1,Mac,profile,0,0,0.0.0.0

legoguy1000 · 2021-05-12T19:10:01Z

Found two more HIPMATCH samples, not a lot of those around:

Oct 09 10:20:15 SumoRedfw01a.sumotest.com 1,2019/10/09 10:20:15,001234567890002,HIPMATCH,0,2304,2019/10/09 10:20:15,ira,vsys1,oh-C02ABCDEFGH4,Mac,67.240.185.235,GP-HIP-PROFILE,1,profile,0,0,0123456789,0x0,0,0,0,0,,SumoRedfw01a,1,0.0.0.0,gh:85:90:99:5a:40,C02ABCDEFGH
Apr 4 22:23:52 panorama.domain 1,2018/04/04 22:23:52,FirewallSerialNumber,749593939,0x8000000000000000,HIPMATCH,0,508,2018/04/04 22:23:50,19,398,0,0,,firewall.name,1,domain\user,vsys1,hostname,8.8.8.8,HIP-PROFILE-RULE,1,Mac,profile,0,0,0.0.0.0

I will add those when I a chance

legoguy1000 · 2021-05-12T21:22:55Z

@adriansr I added 1 of the new samples, the other's format was way off so I ignored it.

mergify · 2021-05-13T11:27:38Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 24350-palo-hipmatch upstream/24350-palo-hipmatch
git merge upstream/master
git push upstream 24350-palo-hipmatch

mergify · 2021-05-14T13:55:57Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 24350-palo-hipmatch upstream/24350-palo-hipmatch
git merge upstream/master
git push upstream 24350-palo-hipmatch

mergify · 2021-05-17T17:13:58Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 24350-palo-hipmatch upstream/24350-palo-hipmatch
git merge upstream/master
git push upstream 24350-palo-hipmatch

mergify · 2021-05-19T11:59:07Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 24350-palo-hipmatch upstream/24350-palo-hipmatch
git merge upstream/master
git push upstream 24350-palo-hipmatch

legoguy1000 · 2021-05-19T12:34:03Z

@adriansr This is ready for CI tests

adriansr · 2021-05-19T12:55:02Z

/test

legoguy1000 · 2021-05-19T15:23:15Z

@adriansr looks GTG

adriansr

Looks good, just a change for the fields.yml and a question about Globalprotect.

adriansr · 2021-05-20T15:28:34Z

x-pack/filebeat/module/panw/panos/_meta/fields.yml

@@ -291,3 +291,43 @@
 type: keyword
 description: >
 The type of tunnel (either SSLVPN or IPSec).
+
+ - name: connect_method


Can you add a default_field: false key to each of the new fields?

We forgot this for the previous filesets. This is done to avoid hitting the limit of ~10k default fields in the index template for filebeat indices.

I updated just the fields I added in this and previous PR. Do you want me to do more??

adriansr · 2021-05-20T15:43:35Z

x-pack/filebeat/module/panw/panos/config/input.yml

+ panw.panos.selection_type: 37
+ panw.panos.response_time: 38
+ panw.panos.priority: 39
+ panw.panos.attempted_gateways: 40
+ panw.panos.gateway: 41


So it's also extracting more fields for GLOBALPROTECT. Out of curiosity, are these documented? I don't see them in the docs.

I was worried that this could cause a failure if the array has less entries, but realized that the fail_on_error: false above will make this backwards compatible.

I have to find where I found them because I didn't see them originally when I did the last PR but then I saw them

Found it https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields.html this is the original link I used which didn't have those extra fields https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields/globalprotect-log-fields-for-pan-os-913-and-later-releases.html#id5795bd71-1dc5-4f82-872d-a9ba6cb7cedf

adriansr · 2021-05-21T19:45:07Z

/test

legoguy1000 · 2021-05-24T12:01:16Z

CI test failures addressed

adriansr · 2021-05-25T10:15:43Z

/test

mergify · 2021-05-25T18:23:07Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 24350-palo-hipmatch upstream/24350-palo-hipmatch
git merge upstream/master
git push upstream 24350-palo-hipmatch

adriansr

LGTM

adriansr · 2021-05-26T07:45:22Z

/test

mergify · 2021-05-26T10:05:42Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 24350-palo-hipmatch upstream/24350-palo-hipmatch
git merge upstream/master
git push upstream 24350-palo-hipmatch

Update panw.panos module to parse HIP Match logs. Also this updates the Global Protect parsing with additional fields per the updated docs, https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields.html (cherry picked from commit 3a81d81) # Conflicts: # filebeat/docs/fields.asciidoc # x-pack/filebeat/module/panw/fields.go # x-pack/filebeat/module/panw/panos/_meta/fields.yml # x-pack/filebeat/module/panw/panos/config/input.yml # x-pack/filebeat/module/panw/panos/ingest/pipeline.yml # x-pack/filebeat/module/panw/panos/ingest/userid.yml # x-pack/filebeat/module/panw/panos/manifest.yml # x-pack/filebeat/module/panw/panos/test/global_protect.log

elasticmachine · 2021-05-26T10:12:16Z

💔 Build Failed

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Build Cause: Pull request #25686 updated
Start Time: 2021-05-26T10:09:56.013+0000
Duration: 2 min 5 sec
Commit: 5af50e2

Trends 🧪

Steps errors

Expand to view the steps failures

`Git fetch`

Took 0 min 1 sec . View more details on here
Description: git fetch https://${GIT_USERNAME}:${GIT_PASSWORD}@github.com/elastic/beats.git +refs/pull/*/head:refs/remotes/origin/pr/* > fetch.log 2>&1

`Archive the artifacts`

Took 0 min 1 sec . View more details on here
Description: fetch.log

Log output

Expand to view the last 100 lines of log output

[2021-05-26T10:09:58.402Z]  > git config --get remote.origin.url # timeout=10
[2021-05-26T10:09:58.408Z] using GIT_SSH to set credentials GitHub user @elasticmachine SSH key
[2021-05-26T10:09:58.415Z]  > git fetch --tags --progress -- origin +refs/heads/*:refs/remotes/origin/* # timeout=10
[2021-05-26T10:09:59.103Z]  > git rev-parse current^{commit} # timeout=10
[2021-05-26T10:09:59.109Z]  > git branch -a -v --no-abbrev --contains 338418b47db64d2f76791e31a598d28cc38d49fc # timeout=10
[2021-05-26T10:09:59.139Z] Selected match: dependabot/maven/com.github.tomakehurst-wiremock-jre8-2.28.0 revision 338418b47db64d2f76791e31a598d28cc38d49fc
[2021-05-26T10:09:59.140Z] The recommended git tool is: git
[2021-05-26T10:09:59.140Z] using credential f6c7695a-671e-4f4f-a331-acdce44ff9ba
[2021-05-26T10:09:59.146Z]  > git rev-parse --resolve-git-dir /var/lib/jenkins/workspace/Beats_beats_PR-25686@libs/apm/.git # timeout=10
[2021-05-26T10:09:59.151Z] Fetching changes from the remote Git repository
[2021-05-26T10:09:59.151Z]  > git config remote.origin.url git@github.com:elastic/apm-pipeline-library.git # timeout=10
[2021-05-26T10:09:59.157Z] Fetching without tags
[2021-05-26T10:09:59.157Z] Fetching upstream changes from git@github.com:elastic/apm-pipeline-library.git
[2021-05-26T10:09:59.157Z]  > git --version # timeout=10
[2021-05-26T10:09:59.162Z]  > git --version # 'git version 2.17.1'
[2021-05-26T10:09:59.162Z] using GIT_SSH to set credentials GitHub user @elasticmachine SSH key
[2021-05-26T10:09:59.167Z]  > git fetch --no-tags --progress -- git@github.com:elastic/apm-pipeline-library.git +refs/heads/*:refs/remotes/origin/* # timeout=10
[2021-05-26T10:09:59.861Z] Checking out Revision 338418b47db64d2f76791e31a598d28cc38d49fc (dependabot/maven/com.github.tomakehurst-wiremock-jre8-2.28.0)
[2021-05-26T10:09:59.861Z]  > git config core.sparsecheckout # timeout=10
[2021-05-26T10:09:59.866Z]  > git checkout -f 338418b47db64d2f76791e31a598d28cc38d49fc # timeout=10
[2021-05-26T10:09:59.882Z] Commit message: "[maven-release-plugin] prepare release v1.1.216"
[2021-05-26T10:10:00.655Z] Excluding src/test/ from checkout of git git@github.com:elastic/apm-pipeline-library.git so that shared library test code cannot be accessed by Pipelines.
[2021-05-26T10:10:00.655Z] To remove this log message, move the test code outside of src/. To restore the previous behavior that allowed access to files in src/test/, pass -Dorg.jenkinsci.plugins.workflow.libs.SCMSourceRetriever.INCLUDE_SRC_TEST_IN_LIBRARIES=true to the java command used to start Jenkins.
[2021-05-26T10:10:16.909Z] Still waiting to schedule task
[2021-05-26T10:10:16.910Z] All nodes of label ‘ubuntu-18&&immutable’ are offline
[2021-05-26T10:11:03.107Z] Running on beats-ci-immutable-ubuntu-1804-1622023803857897701 in /var/lib/jenkins/workspace/Beats_beats_PR-25686
[2021-05-26T10:11:03.240Z] �[39;49m[INFO] Override default checkout�[0m
[2021-05-26T10:11:03.305Z] Sleeping for 10 sec
[2021-05-26T10:11:13.480Z] The recommended git tool is: git
[2021-05-26T10:11:18.121Z] using credential f6c7695a-671e-4f4f-a331-acdce44ff9ba
[2021-05-26T10:11:18.126Z] Wiping out workspace first.
[2021-05-26T10:11:18.196Z] Cloning the remote Git repository
[2021-05-26T10:11:18.196Z] Using shallow clone with depth 10
[2021-05-26T10:11:18.196Z] Avoid fetching tags
[2021-05-26T10:11:18.261Z] Cloning repository git@github.com:elastic/beats.git
[2021-05-26T10:11:18.305Z]  > git init /var/lib/jenkins/workspace/Beats_beats_PR-25686 # timeout=10
[2021-05-26T10:11:18.424Z] Fetching upstream changes from git@github.com:elastic/beats.git
[2021-05-26T10:11:18.424Z]  > git --version # timeout=10
[2021-05-26T10:11:18.429Z]  > git --version # 'git version 2.17.1'
[2021-05-26T10:11:18.429Z] using GIT_SSH to set credentials GitHub user @elasticmachine SSH key
[2021-05-26T10:11:18.456Z]  > git fetch --no-tags --progress -- git@github.com:elastic/beats.git +refs/heads/*:refs/remotes/origin/* # timeout=15
[2021-05-26T10:11:39.534Z] Cleaning workspace
[2021-05-26T10:11:39.547Z] Using shallow fetch with depth 10
[2021-05-26T10:11:39.547Z] Pruning obsolete local branches
[2021-05-26T10:11:39.518Z]  > git config remote.origin.url git@github.com:elastic/beats.git # timeout=10
[2021-05-26T10:11:39.523Z]  > git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
[2021-05-26T10:11:39.530Z]  > git config remote.origin.url git@github.com:elastic/beats.git # timeout=10
[2021-05-26T10:11:39.536Z]  > git rev-parse --verify HEAD # timeout=10
[2021-05-26T10:11:39.540Z] No valid HEAD. Skipping the resetting
[2021-05-26T10:11:39.540Z]  > git clean -fdx # timeout=10
[2021-05-26T10:11:39.553Z] Fetching upstream changes from git@github.com:elastic/beats.git
[2021-05-26T10:11:39.553Z] using GIT_SSH to set credentials GitHub user @elasticmachine SSH key
[2021-05-26T10:11:39.560Z]  > git fetch --no-tags --progress --prune -- git@github.com:elastic/beats.git +refs/pull/25686/head:refs/remotes/origin/PR-25686 +refs/heads/master:refs/remotes/origin/master # timeout=15
[2021-05-26T10:11:40.687Z] Merging remotes/origin/master commit 4065dfdd0b76649e2a6cf046416db0db10abdd6d into PR head commit 5af50e299efdf7e5a908f0aeeb2375ab0ce82f90
[2021-05-26T10:11:40.694Z]  > git config core.sparsecheckout # timeout=10
[2021-05-26T10:11:40.698Z]  > git checkout -f 5af50e299efdf7e5a908f0aeeb2375ab0ce82f90 # timeout=15
[2021-05-26T10:11:42.305Z] Merge succeeded, producing 5af50e299efdf7e5a908f0aeeb2375ab0ce82f90
[2021-05-26T10:11:42.305Z] Checking out Revision 5af50e299efdf7e5a908f0aeeb2375ab0ce82f90 (PR-25686)
[2021-05-26T10:11:42.278Z]  > git remote # timeout=10
[2021-05-26T10:11:42.282Z]  > git config --get remote.origin.url # timeout=10
[2021-05-26T10:11:42.285Z] using GIT_SSH to set credentials GitHub user @elasticmachine SSH key
[2021-05-26T10:11:42.288Z]  > git merge 4065dfdd0b76649e2a6cf046416db0db10abdd6d # timeout=10
[2021-05-26T10:11:42.299Z]  > git rev-parse HEAD^{commit} # timeout=10
[2021-05-26T10:11:42.308Z]  > git config core.sparsecheckout # timeout=10
[2021-05-26T10:11:42.311Z]  > git checkout -f 5af50e299efdf7e5a908f0aeeb2375ab0ce82f90 # timeout=15
[2021-05-26T10:11:47.139Z] Commit message: "Merge branch 'master' into 24350-palo-hipmatch"
[2021-05-26T10:11:47.148Z] First time build. Skipping changelog.
[2021-05-26T10:11:47.148Z] Cleaning workspace
[2021-05-26T10:11:47.649Z] Timeout set to expire in 3 hr 0 min
[2021-05-26T10:11:47.660Z] The timestamps step is unnecessary when timestamps are enabled for all Pipeline builds.
[2021-05-26T10:11:47.814Z] [INFO] Number of builds to be searched 10
[2021-05-26T10:11:48.445Z] [INFO] 'shallow' is forced to be disabled when running on PullRequests
[2021-05-26T10:11:48.456Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-25686@tmp
[2021-05-26T10:11:48.468Z] [INFO] gitCheckout: Checkout SCM PR-25686 with default customisation from the Item.
[2021-05-26T10:11:48.490Z] [INFO] Override default checkout
[2021-05-26T10:11:48.523Z] Sleeping for 10 sec
[2021-05-26T10:11:47.143Z]  > git rev-list --no-walk 4f7a03ed81a7afbce52d5062ce2e350dc2ea5c21 # timeout=10
[2021-05-26T10:11:47.150Z]  > git rev-parse --verify HEAD # timeout=10
[2021-05-26T10:11:47.154Z] Resetting working tree
[2021-05-26T10:11:47.154Z]  > git reset --hard # timeout=10
[2021-05-26T10:11:47.484Z]  > git clean -fdx # timeout=10
[2021-05-26T10:11:58.755Z] Masking supported pattern matches of $GIT_USERNAME or $GIT_PASSWORD
[2021-05-26T10:11:59.417Z] + git fetch https://****:****@github.com/elastic/beats.git +refs/pull/*/head:refs/remotes/origin/pr/*
[2021-05-26T10:11:59.551Z] [WARN] gitCmd failed, further details in the archived file 'fetch.log'
[2021-05-26T10:11:59.671Z] Archiving artifacts
[2021-05-26T10:12:00.457Z] Stage "Lint" skipped due to earlier failure(s)
[2021-05-26T10:12:00.484Z] Stage "Build&Test" skipped due to earlier failure(s)
[2021-05-26T10:12:00.511Z] Stage "Extended" skipped due to earlier failure(s)
[2021-05-26T10:12:00.539Z] Stage "Packaging" skipped due to earlier failure(s)
[2021-05-26T10:12:00.565Z] Stage "Packaging-Pipeline" skipped due to earlier failure(s)
[2021-05-26T10:12:00.609Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-25686/src/github.com/elastic/beats
[2021-05-26T10:12:00.913Z] Running on Jenkins in /var/lib/jenkins/workspace/Beats_beats_PR-25686
[2021-05-26T10:12:01.000Z] [INFO] getVaultSecret: Getting secrets
[2021-05-26T10:12:01.036Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2021-05-26T10:12:01.754Z] + chmod 755 generate-build-data.sh
[2021-05-26T10:12:01.754Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-25686/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-25686/runs/16 FAILURE 125481
[2021-05-26T10:12:01.754Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-25686/runs/16/steps/?limit=10000 -o steps-info.json
[2021-05-26T10:12:01.754Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-25686/runs/16/tests/?status=FAILED -o tests-errors.json
[2021-05-26T10:12:01.754Z] Retry 1/3 exited 22, retrying in 1 seconds...
[2021-05-26T10:12:03.097Z] Retry 2/3 exited 22, retrying in 2 seconds...

❕ Flaky test report

No test was executed to be analysed.

jamiehynds · 2021-06-14T11:50:19Z

@adriansr can our documentation be updated to reflect support for the HIP Match logs and any other logs we've added recently (e.g. Global Protect).

Our documentation currently lists Threat and Traffic logs as supported sources from PANW. https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-panw.html

Update panw.panos module to parse HIP Match logs. Also this updates the Global Protect parsing with additional fields per the updated docs, https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields.html (cherry picked from commit 3a81d81)

Update panw.panos module to parse HIP Match logs. Also this updates the Global Protect parsing with additional fields per the updated docs, https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields.html (cherry picked from commit 3a81d81) Co-authored-by: Alex Resnick <adr8292@gmail.com>

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 12, 2021

legoguy1000 marked this pull request as ready for review May 12, 2021 12:54

adriansr self-requested a review May 12, 2021 18:35

adriansr added backport-v7.14.0 Automated backport with mergify enhancement Filebeat Filebeat review Team:Security-External Integrations labels May 12, 2021

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label May 12, 2021

adriansr added the 7.14 Candidate label May 12, 2021

legoguy1000 force-pushed the 24350-palo-hipmatch branch from 837da68 to 1f875fa Compare May 13, 2021 11:33

legoguy1000 force-pushed the 24350-palo-hipmatch branch from 1f875fa to 15ff3ab Compare May 15, 2021 17:47

legoguy1000 force-pushed the 24350-palo-hipmatch branch from 15ff3ab to 867926b Compare May 18, 2021 02:05

legoguy1000 force-pushed the 24350-palo-hipmatch branch from 867926b to 422a10a Compare May 19, 2021 12:33

adriansr suggested changes May 20, 2021

View reviewed changes

legoguy1000 added 6 commits May 25, 2021 20:15

elastic#24350: Add HIP Match logs

fc1f5e2

update fields

6359234

update changelog

4de2f37

Add additional sample data and update pipeline

9b97739

update default_field: false

e7c490a

fix CI issues

2269f05

legoguy1000 force-pushed the 24350-palo-hipmatch branch from ecbb63b to 2269f05 Compare May 25, 2021 20:15

adriansr approved these changes May 26, 2021

View reviewed changes

Merge branch 'master' into 24350-palo-hipmatch

5af50e2

adriansr merged commit 3a81d81 into elastic:master May 26, 2021

mergify bot mentioned this pull request May 26, 2021

[7.x](backport #25686) [Filebeat] Add HIP Match logs to Palo Alto Module #25867

Merged

legoguy1000 deleted the 24350-palo-hipmatch branch May 26, 2021 11:27

[Filebeat] Add HIP Match logs to Palo Alto Module #25686

[Filebeat] Add HIP Match logs to Palo Alto Module #25686

Conversation

legoguy1000 commented May 12, 2021 • edited Loading

What does this PR do?

Why is it important?

Checklist

Author's Checklist

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

elasticmachine commented May 12, 2021 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

Trends 🧪

💚 Flaky test report

Test stats 🧪

elasticmachine commented May 12, 2021

adriansr commented May 12, 2021

adriansr commented May 12, 2021

legoguy1000 commented May 12, 2021

legoguy1000 commented May 12, 2021

mergify bot commented May 13, 2021

mergify bot commented May 14, 2021

mergify bot commented May 17, 2021

mergify bot commented May 19, 2021

legoguy1000 commented May 19, 2021

adriansr commented May 19, 2021

legoguy1000 commented May 19, 2021

adriansr left a comment

Choose a reason for hiding this comment

adriansr May 20, 2021

Choose a reason for hiding this comment

legoguy1000 May 20, 2021

Choose a reason for hiding this comment

legoguy1000 May 21, 2021

Choose a reason for hiding this comment

adriansr May 20, 2021

Choose a reason for hiding this comment

legoguy1000 May 20, 2021

Choose a reason for hiding this comment

legoguy1000 May 20, 2021 • edited Loading

Choose a reason for hiding this comment

adriansr commented May 21, 2021

legoguy1000 commented May 24, 2021

adriansr commented May 25, 2021

mergify bot commented May 25, 2021

adriansr left a comment

Choose a reason for hiding this comment

adriansr commented May 26, 2021

mergify bot commented May 26, 2021

elasticmachine commented May 26, 2021

💔 Build Failed

Build stats

Trends 🧪

Steps errors

Git fetch

Archive the artifacts

Log output

❕ Flaky test report

jamiehynds commented Jun 14, 2021

legoguy1000 commented May 12, 2021 •

edited

Loading

elasticmachine commented May 12, 2021 •

edited by jenkins-beats-ci bot

Loading

legoguy1000 May 20, 2021 •

edited

Loading

`Git fetch`

`Archive the artifacts`