From b026ddacee15064b0f26056e082943c3fc63c25b Mon Sep 17 00:00:00 2001 From: Gesyk Nazar <77268518+nazargesyk@users.noreply.github.com> Date: Wed, 18 Sep 2024 15:58:47 +0300 Subject: [PATCH 1/2] add aws_cloudtrail for elastic esql --- .../elasticsearch_esql/aws_cloudtrail.yml | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 uncoder-core/app/translator/mappings/platforms/elasticsearch_esql/aws_cloudtrail.yml diff --git a/uncoder-core/app/translator/mappings/platforms/elasticsearch_esql/aws_cloudtrail.yml b/uncoder-core/app/translator/mappings/platforms/elasticsearch_esql/aws_cloudtrail.yml new file mode 100644 index 00000000..24c41162 --- /dev/null +++ b/uncoder-core/app/translator/mappings/platforms/elasticsearch_esql/aws_cloudtrail.yml @@ -0,0 +1,57 @@ +platform: ElasticSearch ES|QL +source: aws_cloudtrail +log_source: + index: [logs-*] +default_log_source: + index: logs-* +field_mapping: + additionalEventdata: aws.cloudtrail.additional_eventdata + apiVersion: aws.cloudtrail.api_version + awsRegion: cloud.region + errorCode: aws.cloudtrail.error_code + errorMessage: aws.cloudtrail.error_message + eventID: event.id + eventName: event.action + eventSource: event.provider + eventTime: '@timestamp' + eventType: aws.cloudtrail.event_type + eventVersion: aws.cloudtrail.event_version + managementEvent: aws.cloudtrail.management_event + readOnly: aws.cloudtrail.read_only + requestID: aws.cloudtrail.request_id + requestParameters: aws.cloudtrail.request_parameters + resources.accountId: aws.cloudtrail.resources.account_id + resources.ARN: aws.cloudtrail.resources.arn + resources.type: aws.cloudtrail.resources.type + responseElements: aws.cloudtrail.response_elements + serviceEventDetails: aws.cloudtrail.service_event_details + sharedEventId: aws.cloudtrail.shared_event_id + sourceIPAddress: source.address + userAgent: user_agent + userIdentity.accessKeyId: aws.cloudtrail.user_identity.access_key_id + userIdentity.accountId: cloud.account.id + userIdentity.arn: aws.cloudtrail.user_identity.arn + userIdentity.invokedBy: aws.cloudtrail.user_identity.invoked_by + userIdentity.principalId: user.id + userIdentity.sessionContext.attributes.creationDate: aws.cloudtrail.user_identity.session_context.creation_date + userIdentity.sessionContext.attributes.mfaAuthenticated: aws.cloudtrail.user_identity.session_context.mfa_authenticated + userIdentity.sessionContext.sessionIssuer.userName: role.name + userIdentity.type: aws.cloudtrail.user_identity.type + userIdentity.userName: user.name + vpcEndpointId: aws.cloudtrail.vpc_endpoint_id +overrides: + - field: event.outcome + value: failure + regexes: + - (\(\(aws.cloudtrail.error_message.keyword:.* event.action:\"ConsoleLogin\"\)\)) + - (\(\(aws.cloudtrail.error_code.keyword:.* event.action:\"ConsoleLogin\"\)\)) + - (\(\(aws.cloudtrail.error_message.keyword:.* aws.cloudtrail.response_elements.keyword:\*Failure\*\)\)) + - (\(\(aws.cloudtrail.error_code.keyword:.* aws.cloudtrail.response_elements.keyword:\*Failure\*\)\)) + - (\(\(event.action:\"ConsoleLogin\".* aws.cloudtrail.error_message.keyword:\*\)\)) + - (\(\(event.action:\"ConsoleLogin\".* aws.cloudtrail.error_code.keyword:\*\)\)) + - (\(\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_message.keyword:\*\)\)) + - (\(\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_code.keyword:\*\)\)) + - field: event.outcome + value: success + literals: + - 'NOT (event.outcome:failure)' \ No newline at end of file From dead305e047386ba1c2de475f8e85430fe941a9a Mon Sep 17 00:00:00 2001 From: Gesyk Nazar <77268518+nazargesyk@users.noreply.github.com> Date: Wed, 18 Sep 2024 15:58:52 +0300 Subject: [PATCH 2/2] gis-1809 update elastic-esql-query mapping --- .../elasticsearch_esql/aws_cloudtrail.yml | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/uncoder-core/app/translator/mappings/platforms/elasticsearch_esql/aws_cloudtrail.yml b/uncoder-core/app/translator/mappings/platforms/elasticsearch_esql/aws_cloudtrail.yml index 24c41162..81bf4594 100644 --- a/uncoder-core/app/translator/mappings/platforms/elasticsearch_esql/aws_cloudtrail.yml +++ b/uncoder-core/app/translator/mappings/platforms/elasticsearch_esql/aws_cloudtrail.yml @@ -39,19 +39,3 @@ field_mapping: userIdentity.type: aws.cloudtrail.user_identity.type userIdentity.userName: user.name vpcEndpointId: aws.cloudtrail.vpc_endpoint_id -overrides: - - field: event.outcome - value: failure - regexes: - - (\(\(aws.cloudtrail.error_message.keyword:.* event.action:\"ConsoleLogin\"\)\)) - - (\(\(aws.cloudtrail.error_code.keyword:.* event.action:\"ConsoleLogin\"\)\)) - - (\(\(aws.cloudtrail.error_message.keyword:.* aws.cloudtrail.response_elements.keyword:\*Failure\*\)\)) - - (\(\(aws.cloudtrail.error_code.keyword:.* aws.cloudtrail.response_elements.keyword:\*Failure\*\)\)) - - (\(\(event.action:\"ConsoleLogin\".* aws.cloudtrail.error_message.keyword:\*\)\)) - - (\(\(event.action:\"ConsoleLogin\".* aws.cloudtrail.error_code.keyword:\*\)\)) - - (\(\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_message.keyword:\*\)\)) - - (\(\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_code.keyword:\*\)\)) - - field: event.outcome - value: success - literals: - - 'NOT (event.outcome:failure)' \ No newline at end of file pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy