[prisma_access] Initial release of the Prisma Access #10399

muskan-agarwal26 · 2024-07-05T17:40:21Z

Proposed commit message

Added an event data stream.
Added data collection logic for event data stream.
Added the ingest pipeline for event data stream.
Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files.
Added dashboards and visualizations.
Added test for pipeline for event data stream.
Added system test cases for event data stream.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/prisma_access directory.
Run the following command to run tests.

elastic-package test
Test-verbose.txt

Screenshots

elasticmachine · 2024-07-08T12:10:11Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

kcreddy · 2024-07-16T10:15:12Z

/test

elasticmachine · 2024-07-16T10:33:45Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

kcreddy · 2024-07-16T14:54:37Z

packages/prisma_access/manifest.yml

@@ -0,0 +1,70 @@
+format_version: 3.1.4
+name: prisma_access


@jamiehynds, can you confirm the name of the integration?
It seems to me that it should be panw_prisma_access just like panw_cortex_xdr

Good catch @kcreddy. Probably best to keep the name inline with other Palo integrations and include panw. Does this impact custom field names too or just the name in the manifest?

It does impact the field names too.
cc: @muskan-agarwal26

What do we use for prisma cloud? is it panw_prisma_cloud or prisma_cloud?

What do we use for prisma cloud? is it panw_prisma_cloud or prisma_cloud?

We seem to use prisma_cloud as both package name and also in field names.

Ok, goes against the grain a bit, but lets keep prisma_access here to align with prisma_cloud which has been around for awhile.

packages/prisma_access/manifest.yml

packages/prisma_access/_dev/build/docs/README.md

packages/prisma_access/data_stream/event/_dev/test/pipeline/test-event.json-expected.json

packages/prisma_access/data_stream/event/_dev/test/pipeline/test-event.json

1. Implemented the Readme changes. 2. Added network category in the manifest. 3. Added comments for the scripts used. 4. Changed the context of the test-logs. 5. Split user.domain.user.name for the user fields.

kcreddy · 2024-07-26T18:04:07Z

packages/prisma_access/data_stream/event/sample_event.json

@@ -0,0 +1,187 @@
+{
+    "@timestamp": "2019-07-25T23:30:12.000Z",


This timestamp should be derived with event.timezone offset

kcreddy · 2024-07-26T18:08:22Z

packages/prisma_access/data_stream/event/_dev/test/pipeline/test-event.json-expected.json

+                    "cortex_data_lake_tenant_id": "xxxxxxxxxxxxx",
+                    "destination": {
+                        "address": {
+                            "v6": "FE80:CD00:0000:0CDE:1257:0000:211E:729C"


Lets make this lowercase as per RFC5952

1. Derived timestamo from event.timezone. 2. Lowercase the ipv6.

kcreddy · 2024-07-29T08:44:40Z

/test

kcreddy · 2024-07-29T08:50:34Z

packages/prisma_access/data_stream/event/elasticsearch/ingest_pipeline/default.yml

@@ -2836,6 +2831,54 @@ processors:
      tag: set_event_timezone_from_event_log_source_timezone_offset
      copy_from: prisma_access.event.log.source.timezone_offset
      ignore_empty_value: true
+  - date:


Instead of null, non-null conditions and defining date processors for each case, can you follow this approach to set event.timezone to UTC default before the single date processor?

https://github.com/elastic/integrations/blob/main/packages/zscaler_zia/data_stream/endpoint_dlp/elasticsearch/ingest_pipeline/default.yml#L377-L401

kcreddy · 2024-07-29T09:23:50Z

/test

elasticmachine · 2024-07-29T09:42:41Z

💚 Build Succeeded

Buildkite Build
Commit: fb5bf48

History

💚 Build #14088 succeeded 4e07075
💚 Build #13699 succeeded e844b66

elastic-sonarqube · 2024-07-29T09:42:46Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
98.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elasticmachine · 2024-07-29T10:28:24Z

Package prisma_access - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=prisma_access

Initial release of the Prisma Access. - Added an event data stream. - Added data collection logic for event data stream. - Added the ingest pipeline for event data stream. - Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files. - Added dashboards and visualizations. - Added test for pipeline for event data stream. - Added system test cases for event data stream.

muskan-agarwal26 added 2 commits July 5, 2024 22:41

Initial release

7f6ec15

Updated changelog entry

e844b66

jamiehynds requested a review from a team July 8, 2024 12:10

jamiehynds added the Team:Security-Service Integrations Security Service Integrations Team [elastic/security-service-integrations] label Jul 8, 2024

jamiehynds added the New Integration Issue or pull request for creating a new integration package. label Jul 8, 2024

kcreddy added the Crest label Jul 12, 2024

kcreddy reviewed Jul 16, 2024

View reviewed changes

Resolved comments

055d852

1. Implemented the Readme changes. 2. Added network category in the manifest. 3. Added comments for the scripts used. 4. Changed the context of the test-logs. 5. Split user.domain.user.name for the user fields.

muskan-agarwal26 requested a review from kcreddy July 25, 2024 11:08

kcreddy reviewed Jul 26, 2024

View reviewed changes

Resolved comment

4e07075

1. Derived timestamo from event.timezone. 2. Lowercase the ipv6.

muskan-agarwal26 requested a review from kcreddy July 29, 2024 08:45

kcreddy reviewed Jul 29, 2024

View reviewed changes

Added set processor to set UTC in event.timezone, if null

fb5bf48

muskan-agarwal26 requested a review from kcreddy July 29, 2024 09:15

kcreddy approved these changes Jul 29, 2024

View reviewed changes

kcreddy merged commit aba9540 into elastic:main Jul 29, 2024
5 checks passed

andrewkroh added the Integration:prisma_access Palo Alto Prisma Access label Jul 29, 2024

cpascale43 added the 8.16 candidate label Jul 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[prisma_access] Initial release of the Prisma Access #10399

[prisma_access] Initial release of the Prisma Access #10399

muskan-agarwal26 commented Jul 5, 2024

elasticmachine commented Jul 8, 2024

kcreddy commented Jul 16, 2024

elasticmachine commented Jul 16, 2024

kcreddy Jul 16, 2024

jamiehynds Jul 26, 2024

kcreddy Jul 26, 2024

jamiehynds Jul 26, 2024

kcreddy Jul 26, 2024

jamiehynds Jul 26, 2024

kcreddy Jul 26, 2024

kcreddy Jul 26, 2024

kcreddy commented Jul 29, 2024

kcreddy Jul 29, 2024 •

edited

Loading

kcreddy commented Jul 29, 2024

elasticmachine commented Jul 29, 2024

elastic-sonarqube bot commented Jul 29, 2024

elasticmachine commented Jul 29, 2024

[prisma_access] Initial release of the Prisma Access #10399

[prisma_access] Initial release of the Prisma Access #10399

Conversation

muskan-agarwal26 commented Jul 5, 2024

Proposed commit message

Checklist

How to test this PR locally

Screenshots

elasticmachine commented Jul 8, 2024

kcreddy commented Jul 16, 2024

elasticmachine commented Jul 16, 2024

🚀 Benchmarks report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kcreddy commented Jul 29, 2024

kcreddy Jul 29, 2024 • edited Loading

Choose a reason for hiding this comment

kcreddy commented Jul 29, 2024

elasticmachine commented Jul 29, 2024

💚 Build Succeeded

History

elastic-sonarqube bot commented Jul 29, 2024

Quality Gate passed

elasticmachine commented Jul 29, 2024

kcreddy Jul 29, 2024 •

edited

Loading