forked from elastic/integrations
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Cisco Duo] Integration updates (elastic#11200)
Added new data stream telephony_v2 to support the new v2 API endpoint. Updated the auth data stream to migrate from the HTTPJSON to CEL. Review documentation and dashboards
- Loading branch information
1 parent
27f35c8
commit b0c20d8
Showing
36 changed files
with
2,454 additions
and
703 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
162 changes: 162 additions & 0 deletions
162
packages/cisco_duo/data_stream/auth/agent/stream/cel.yml.hbs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,162 @@ | ||
| config_version: 2 | ||
| interval: {{interval}} | ||
| resource.url: {{hostname}} | ||
|
|
||
| {{#if enable_request_tracer}} | ||
| resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson" | ||
| resource.tracer.maxbackups: 5 | ||
| resource.tracer.maxsize: 5 | ||
| {{/if}} | ||
|
|
||
| regexp: | ||
| "next_offset_timestamp": '^\d+' | ||
|
|
||
| state: | ||
| url: {{hostname}} | ||
| integration_key: {{integration_key}} | ||
| secret_key: {{secret_key}} | ||
| limit: {{limit}} | ||
| initial_interval: {{initial_interval}} | ||
| want_more: false | ||
| redact: | ||
| fields: | ||
| - secret_key | ||
|
|
||
| program: | | ||
| ( | ||
| state.want_more ? | ||
| state | ||
| : | ||
| state.with({ | ||
| "mintime": state.?cursor.last_published.orValue(int(now - duration(state.initial_interval)) * 1000), | ||
| "maxtime": int(now - duration("2m")) * 1000, | ||
| "date": now.format(time_layout.RFC1123Z), | ||
| }) | ||
| ).as(state, state.with( | ||
| request( | ||
| "GET", | ||
| state.?want_more.orValue(false) ? | ||
| state.next_url | ||
| : | ||
| state.url.trim_right("/") + "/admin/v2/logs/authentication?" + { | ||
| "limit": [string(int(state.limit))], | ||
| "maxtime": [string(int(state.maxtime))], | ||
| "mintime": [string(int(state.mintime))], | ||
| "sort": ["ts:asc"], | ||
| }.format_query() | ||
| ).with( | ||
| { | ||
| "Header": { | ||
| "Content-Type": ["application/x-www-form-urlencoded"], | ||
| "Date": [state.date], | ||
| "Authorization": ["Basic " + ( | ||
| state.integration_key + ":" + ( | ||
| [ | ||
| state.date, | ||
| "GET", | ||
| state.url.trim_prefix("https://"), | ||
| "/admin/v2/logs/authentication", | ||
| { | ||
| "limit": [string(int(state.limit))], | ||
| "maxtime": [string(int(state.maxtime))], | ||
| "mintime": [string(int(state.mintime))], | ||
| ?"next_offset": has(state.next_offset) ? | ||
| optional.of([string(state.next_offset)]) | ||
| : | ||
| optional.none(), | ||
| "sort": ["ts:asc"], | ||
| }.format_query() | ||
| ].join("\n") | ||
| .hmac("sha1", bytes(state.secret_key)) | ||
| .hex() | ||
| ) | ||
| ).base64()], | ||
| }, | ||
| } | ||
| ).do_request().as(resp, (resp.StatusCode == 200) ? | ||
| bytes(resp.Body).decode_json().as(body, has(body.?response.authlogs) && size(body.response.authlogs) > 0 ? | ||
| { | ||
| "events": body.response.authlogs.map(item, | ||
| { | ||
| "message": item.encode_json(), | ||
| } | ||
| ), | ||
| "url": state.url, | ||
| "integration_key": state.integration_key, | ||
| "secret_key": state.secret_key, | ||
| "limit": state.limit, | ||
| "mintime": state.mintime, | ||
| "maxtime": state.maxtime, | ||
| "date": now.format(time_layout.RFC1123Z), | ||
| "want_more": has(body.?response.?metadata.next_offset), | ||
| ?"next_offset": (has(body.?response.?metadata.next_offset) && body.response.metadata.next_offset != null) ? | ||
| optional.of(string(body.response.metadata.next_offset)) | ||
| : | ||
| optional.none(), | ||
| "next_url": (has(body.?response.?metadata.next_offset) && body.response.metadata.next_offset != null) ? | ||
| ( | ||
| state.url.trim_right("/") + "/admin/v2/logs/authentication?" + { | ||
| "limit": [string(int(state.limit))], | ||
| "maxtime": [string(int(state.maxtime))], | ||
| "mintime": [string(int(state.mintime))], | ||
| "next_offset": [string(body.response.metadata.next_offset)], | ||
| "sort": ["ts:asc"], | ||
| }.format_query() | ||
| ) | ||
| : | ||
| state.url, | ||
| "cursor": { | ||
| ?"last_published": (has(body.?response.?metadata.next_offset) && body.response.metadata.next_offset != null) ? | ||
| optional.of(body.response.metadata.next_offset.re_find("next_offset_timestamp")) | ||
| : | ||
| optional.none(), | ||
| } | ||
| } | ||
| : | ||
| { | ||
| "events":[], | ||
| "want_more": false, | ||
| } | ||
|
|
||
| ) | ||
| : | ||
| bytes(resp.Body).decode_json().as(body, | ||
| { | ||
| "events": { | ||
| "error": { | ||
| "code": has(body.code) ? string(body.code) : string(resp.StatusCode), | ||
| "id": string(resp.Status), | ||
| "message": "GET: " + | ||
| ( | ||
| (has(body.message) && body.message != "") ? | ||
| string(body.message) + | ||
| (has(body.message_detail) ? | ||
| ": " + string(body.message_detail) | ||
| : | ||
| "" | ||
| ) | ||
| : | ||
| string(resp.Status) + " (" + string(resp.StatusCode) + ")" | ||
| ), | ||
| }, | ||
| }, | ||
| "want_more": false, | ||
| } | ||
| ) | ||
| ) | ||
| )) | ||
|
|
||
| tags: | ||
| {{#if preserve_original_event}} | ||
| - preserve_original_event | ||
| {{/if}} | ||
| {{#each tags as |tag|}} | ||
| - {{tag}} | ||
| {{/each}} | ||
| {{#contains "forwarded" tags}} | ||
| publisher_pipeline.disable_host: true | ||
| {{/contains}} | ||
| {{#if processors}} | ||
| processors: | ||
| {{processors}} | ||
| {{/if}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.