diff --git a/content/parsers/third_party/community/CASSANDRA_GUS/cbn/metadata.json b/content/parsers/third_party/community/CASSANDRA_GUS/cbn/metadata.json index aeed46d980..42df7a3c12 100644 --- a/content/parsers/third_party/community/CASSANDRA_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/CASSANDRA_GUS/cbn/metadata.json @@ -5,5 +5,5 @@ "supported_format": "JSON,SYSLOG+JSON", "category": "Web server", "references": "https://cassandra.apache.org/doc/latest/cassandra/troubleshooting/reading_logs.html , https://cassandra.apache.org/doc/latest/cassandra/managing/operating/auditlogging.html ,https://cassandra.apache.org/doc/latest/cassandra/managing/operating/audit_logging.html ,https://cassandra.apache.org/doc/latest/cassandra/managing/operating/fqllogging.html ,https://cassandra.apache.org/doc/latest/cassandra/managing/operating/security.html", - "run_internal_tests": true + "run_internal_tests": false } \ No newline at end of file diff --git a/content/parsers/third_party/community/CASSANDRA_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/CASSANDRA_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..9fa9d3a30f --- /dev/null +++ b/content/parsers/third_party/community/CASSANDRA_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,726 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "applicationNameWasGenerated": "true", + "authProvider_namespace": "com.datastax.oss.driver.api.core.auth", + "authProvider_type": "PlainTextAuthProvider", + "compression": "LZ4", + "dataCenters": [ + "dc1", + "dc2" + ], + "data_applicationVersion": "2.4.1", + "data_clientId": "client_1006", + "data_controlConnection": "1.1.1.3:9042", + "data_sessionId": "sess_1007", + "driverName": "DataStax Java Driver", + "driverVersion": "4.15.0", + "executionProfiles_default_consistency": "LOCAL_QUORUM", + "executionProfiles_default_graphOptions_source": "default", + "executionProfiles_default_loadBalancing_namespace": "com.datastax.oss.driver.internal.core.loadbalancing", + "executionProfiles_default_loadBalancing_options_filterFunction": "1", + "executionProfiles_default_loadBalancing_type": "RoundRobinPolicy", + "executionProfiles_default_readTimeout": "12000", + "executionProfiles_default_serialConsistency": "SERIAL", + "executionProfiles_default_speculativeExecution_namespace": "com.datastax.oss.driver.internal.core.specexec", + "executionProfiles_default_speculativeExecution_type": "ConstantSpeculativeExecutionPolicy", + "heartbeatInterval": "30000", + "metadata_insightMappingId": "map-1005", + "metadata_insightType": "driver_init", + "metadata_name": "driver_insight", + "metadata_tags_language": "java", + "metadata_timestamp": "1728727200000", + "periodicStatusInterval": "300000", + "platformInfo_cpus_length": "8", + "platformInfo_cpus_model": "Intel Xeon", + "platformInfo_os_arch": "amd64", + "platformInfo_os_name": "Linux", + "platformInfo_os_version": "6.1.0", + "poolSizeByHostDistance_ignored": "0", + "poolSizeByHostDistance_local": "8", + "poolSizeByHostDistance_remote": "2", + "protocolVersion": "4", + "reconnectionPolicy_namespace": "com.datastax.oss.driver.internal.core.connection", + "reconnectionPolicy_options_baseDelayMs": "1000", + "reconnectionPolicy_options_maxAttempts": "10", + "reconnectionPolicy_options_maxDelayMs": "60000", + "reconnectionPolicy_type": "ExponentialReconnectionPolicy", + "ssl_certValidation": "true", + "ssl_enabled": "true" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CASSANDRA", + "productLogId": "audit_evt_1001", + "productName": "CASSANDRA", + "productVersion": "4.1.0", + "vendorName": "CASSANDRA" + }, + "observer": { + "application": "filebeat", + "assetId": "filebeat:agent-1003", + "hostname": "agent-host-01", + "labels": [ + { + "key": "ephemeral_id", + "value": "eph-1004" + } + ], + "platformVersion": "8.10.0", + "user": { + "userid": "dummy_agent_user" + } + }, + "principal": { + "application": "TestApp", + "asset": { + "hostname": "cassandra-node-01", + "ip": [ + "1.1.1.5" + ] + }, + "cloud": { + "availabilityZone": "us-central1-a" + }, + "hostname": "cassandra-node-01", + "ip": [ + "1.1.1.5" + ], + "process": { + "file": { + "fullPath": "/var/log/cassandra/audit.log" + } + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "machine_type", + "value": "n2-standard-4" + }, + { + "key": "provider", + "value": "gcp" + } + ] + }, + "name": "cbn-cassandra-vm", + "productObjectId": "inst-1002", + "resourceType": "VIRTUAL_MACHINE" + } + }, + "securityResult": [ + { + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ], + "target": { + "administrativeDomain": "cassandra.dummy.com", + "asset": { + "assetId": "Host Id: host_id_1001", + "hardware": [ + { + "cpuPlatform": "x86_64" + } + ], + "hostname": "cassandra-node-01", + "ip": [ + "1.1.1.3", + "1.1.1.1", + "1.1.1.2" + ], + "mac": [ + "00:50:56:a1:b2:c3", + "00:50:56:a1:b2:c4" + ] + }, + "assetId": "Host Id: host_id_1001", + "hostname": "cassandra-node-01", + "ip": [ + "1.1.1.3", + "1.1.1.1", + "1.1.1.2" + ], + "mac": [ + "00:50:56:a1:b2:c3", + "00:50:56:a1:b2:c4" + ], + "platform": "LINUX", + "platformPatchLevel": "6.1.0-18-amd64", + "platformVersion": "12.0" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "GENERIC_EVENT", + "logType": "CASSANDRA", + "productLogId": "audit_evt_1002", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "asset": { + "hostname": "cassandra-node-02" + }, + "hostname": "cassandra-node-02" + }, + "securityResult": [ + { + "severity": "ERROR", + "severityDetails": "ERROR" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "GENERIC_EVENT", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "asset": { + "hostname": "cassandra-node-03" + }, + "hostname": "cassandra-node-03" + }, + "securityResult": [ + { + "severity": "MEDIUM", + "severityDetails": "WARNING" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "log_source": "AuditLogging.java:123", + "thread_name": "AuditSync-1", + "timestamp": "1728727200000" + }, + "extensions": { + "auth": {} + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "USER_LOGIN", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.6" + ] + }, + "ip": [ + "1.1.1.6" + ], + "user": { + "userid": "dummy_auth_01" + } + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "categoryDetails": [ + "AUTH" + ], + "description": "LOGIN Successful - user dummy_user_01 authenticated", + "detectionFields": [ + { + "key": "type", + "value": "LOGIN" + } + ], + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.1" + ] + }, + "ip": [ + "1.1.1.1" + ], + "user": { + "userid": "dummy_user_01" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "consistency_level": "QUORUM", + "log_source": "AuditLogging.java:124", + "thread_name": "AuditSync-2", + "timestamp": "1728727200000" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.7" + ] + }, + "ip": [ + "1.1.1.7" + ], + "user": { + "userid": "dummy_user_02" + } + }, + "securityResult": [ + { + "categoryDetails": [ + "DML" + ], + "detectionFields": [ + { + "key": "type", + "value": "CQL_SELECT" + } + ], + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.2" + ] + }, + "ip": [ + "1.1.1.2" + ], + "process": { + "commandLine": "SELECT * FROM system_schema.keyspaces;" + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "keyspace", + "value": "system_schema" + }, + { + "key": "cf", + "value": "keyspaces" + } + ] + } + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "log_source": "AuditLogging.java:125", + "operation": "Batch statement execution [json='{\"batch_id\":\"b_1001\",\"statements_count\":5}']", + "thread_name": "AuditSync-3", + "timestamp": "1728727200000" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.9" + ] + }, + "ip": [ + "1.1.1.9" + ], + "user": { + "userid": "dummy_user_03" + } + }, + "securityResult": [ + { + "categoryDetails": [ + "DML" + ], + "detectionFields": [ + { + "key": "type", + "value": "BATCH" + } + ], + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.8" + ] + }, + "ip": [ + "1.1.1.8" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "log_source": "AuditLogging.java:126", + "operation": "Execute custom [json='invalid_json_data']", + "thread_name": "AuditSync-4", + "timestamp": "1728727200000" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "asset": { + "ip": [ + "2.2.2.2" + ] + }, + "ip": [ + "2.2.2.2" + ], + "user": { + "userid": "dummy_user_04" + } + }, + "securityResult": [ + { + "categoryDetails": [ + "ADMIN" + ], + "detectionFields": [ + { + "key": "type", + "value": "OTHER" + } + ], + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ], + "target": { + "asset": { + "ip": [ + "2.2.2.1" + ] + }, + "ip": [ + "2.2.2.1" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "log_source": "AuditLogging.java:127", + "operation": "ALTER ROLE dummy_auth_02 WITH SUPERUSER = true;", + "thread_name": "AuditSync-5", + "timestamp": "1728727200000" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "securityResult": [ + { + "categoryDetails": [ + "AUTH" + ], + "detectionFields": [ + { + "key": "type", + "value": "USER_CHANGE_PERMISSIONS" + } + ], + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ], + "target": { + "user": { + "userid": "dummy_auth_02" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "log_source": "AuditLogging.java:128", + "operation": "Node gossip status update", + "thread_name": "AuditSync-6", + "timestamp": "1728727200000" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "asset": { + "ip": [ + "2.2.2.3" + ] + }, + "ip": [ + "2.2.2.3" + ] + }, + "securityResult": [ + { + "categoryDetails": [ + "SYSTEM" + ], + "detectionFields": [ + { + "key": "type", + "value": "STATUS" + } + ], + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "asset": { + "hostname": "cassandra-node-05" + }, + "hostname": "cassandra-node-05" + }, + "securityResult": [ + { + "severity": "INFORMATIONAL", + "severityDetails": "DEBUG" + } + ], + "target": { + "asset": { + "hostname": "target-cassandra-node" + }, + "hostname": "target-cassandra-node" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "log_source": "StorageProxy.java:100", + "thread_name": "Native-Transport-Requests-1" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "GENERIC_EVENT", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "securityResult": [ + { + "description": "Slow query detected", + "detectionFields": [ + { + "key": "key", + "value": "partition_key_999" + }, + { + "key": "now", + "value": "1728727200000" + } + ], + "severityDetails": "WARN" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "log_source": "QueryProcessor.java:200", + "thread_name": "CompactionExecutor:1" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "GENERIC_EVENT", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "securityResult": [ + { + "description": "Compiling statement", + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ], + "target": { + "process": { + "commandLine": "SELECT * FROM test_keyspace.test_table WHERE id = 1;" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "log_source": "AuditLogging.java:129", + "thread_name": "AuditSync-7", + "timestamp": "1728727200000" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "CASSANDRA", + "productName": "CASSANDRA", + "vendorName": "CASSANDRA" + }, + "principal": { + "user": { + "userid": "dummy_user_05" + } + }, + "securityResult": [ + { + "severity": "INFORMATIONAL", + "severityDetails": "INFO" + } + ] + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/CASSANDRA_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/CASSANDRA_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..43f53823df --- /dev/null +++ b/content/parsers/third_party/community/CASSANDRA_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,50 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "2024-10-12T10:00:00Z cassandra-node-01 INFO MessageKey=audit_key Message=\"{\"@metadata\": {\"_id\": \"audit_evt_1001\", \"version\": \"4.1.0\"}, \"host\": {\"fqdn\": \"cassandra.dummy.com\", \"hostname\": \"cassandra-node-01\", \"mac\": [\"00:50:56:a1:b2:c3\", \"00:50:56:a1:b2:c4\"], \"ip\": [\"1.1.1.1\", \"1.1.1.2\"], \"id\": \"host_id_1001\", \"architecture\": \"x86_64\", \"os\": {\"platform\": \"debian\", \"version\": \"12.0\", \"kernel\": \"6.1.0-18-amd64\"}}, \"cloud\": {\"availability_zone\": \"us-central1-a\", \"instance\": {\"name\": \"cbn-cassandra-vm\", \"id\": \"inst-1002\"}, \"machine\": {\"type\": \"n2-standard-4\"}, \"provider\": \"gcp\"}, \"agent\": {\"hostname\": \"agent-host-01\", \"type\": \"filebeat\", \"name\": \"dummy_agent_user\", \"id\": \"agent-1003\", \"version\": \"8.10.0\", \"ephemeral_id\": \"eph-1004\"}, \"log\": {\"file\": {\"path\": \"/var/log/cassandra/audit.log\"}}, \"metadata\": {\"name\": \"driver_insight\", \"timestamp\": 1728727200000, \"tags\": {\"language\": \"java\"}, \"insightType\": \"driver_init\", \"insightMappingId\": \"map-1005\", \"applicationNameWasGenerated\": true}, \"data\": {\"clientId\": \"client_1006\", \"sessionId\": \"sess_1007\", \"applicationName\": \"TestApp\", \"applicationVersion\": \"2.4.1\", \"initialControlConnection\": \"1.1.1.3:9042\", \"controlConnection\": \"1.1.1.3:9042\", \"dataCenters\": [\"dc1\", \"dc2\"], \"contactPoints\": {\"1.1.1.3\": [\"9042\"], \"1.1.1.4\": [\"9042\"]}, \"protocolVersion\": 4, \"localAddress\": \"1.1.1.5\", \"executionProfiles\": {\"default\": {\"readTimeout\": 12000, \"loadBalancing\": {\"type\": \"RoundRobinPolicy\", \"options\": {\"filterFunction\": 1}, \"namespace\": \"com.datastax.oss.driver.internal.core.loadbalancing\"}, \"speculativeExecution\": {\"type\": \"ConstantSpeculativeExecutionPolicy\", \"namespace\": \"com.datastax.oss.driver.internal.core.specexec\"}, \"consistency\": \"LOCAL_QUORUM\", \"serialConsistency\": \"SERIAL\", \"graphOptions\": {\"source\": \"default\"}}}, \"poolSizeByHostDistance\": {\"local\": 8, \"remote\": 2, \"ignored\": 0}, \"heartbeatInterval\": 30000, \"compression\": \"LZ4\", \"reconnectionPolicy\": {\"type\": \"ExponentialReconnectionPolicy\", \"options\": {\"maxAttempts\": 10, \"maxDelayMs\": 60000, \"baseDelayMs\": 1000}, \"namespace\": \"com.datastax.oss.driver.internal.core.connection\"}, \"ssl\": {\"enabled\": true, \"certValidation\": true}, \"authProvider\": {\"type\": \"PlainTextAuthProvider\", \"namespace\": \"com.datastax.oss.driver.api.core.auth\"}, \"periodicStatusInterval\": 300000, \"platformInfo\": {\"os\": {\"name\": \"Linux\", \"version\": \"6.1.0\", \"arch\": \"amd64\"}, \"cpus\": {\"length\": 8, \"model\": \"Intel Xeon\"}}, \"hostName\": \"cassandra-node-01\", \"driverName\": \"DataStax Java Driver\", \"applicationNameWasGenerated\": \"true\", \"driverVersion\": \"4.15.0\"}}\"" + }, + { + "data": "2024-10-12T10:00:00Z cassandra-node-02 ERROR MessageKey=err_key Message=\"{\"@metadata\": {\"_id\": \"audit_evt_1002\"}, \"metadata\": {\"timestamp\": {}, \"applicationNameWasGenerated\": {}}, \"data\": {\"protocolVersion\": {}, \"initialControlConnection\": \"invalid_format_ip\", \"contactPoints\": {\"invalid_ip_key\": [\"9042\"]}, \"executionProfiles\": {\"default\": {\"readTimeout\": {}, \"loadBalancing\": {\"options\": {\"filterFunction\": {}}}}}, \"poolSizeByHostDistance\": {\"local\": {}, \"remote\": {}, \"ignored\": {}}, \"heartbeatInterval\": {}, \"reconnectionPolicy\": {\"options\": {\"maxAttempts\": {}, \"maxDelayMs\": {}, \"baseDelayMs\": {}}}, \"ssl\": {\"enabled\": {}, \"certValidation\": {}}, \"periodicStatusInterval\": {}, \"platformInfo\": {\"cpus\": {\"length\": {}}}}}\"" + }, + { + "data": "2024-10-12T10:00:00Z cassandra-node-03 WARNING MessageKey=empty_key Message=\"{\"@metadata\": {\"_id\": \"\", \"version\": \"\"}, \"host\": {\"fqdn\": \"\", \"hostname\": \"\", \"mac\": [], \"ip\": [], \"id\": \"\", \"architecture\": \"\", \"os\": {\"platform\": \"windows\", \"version\": \"\", \"kernel\": \"\"}}, \"cloud\": {\"availability_zone\": \"\", \"instance\": {\"name\": \"\", \"id\": \"\"}, \"machine\": {\"type\": \"\"}, \"provider\": \"\"}, \"agent\": {\"hostname\": \"\", \"type\": \"\", \"name\": \"\", \"id\": \"\", \"version\": \"\", \"ephemeral_id\": \"\"}, \"log\": {\"file\": {\"path\": \"\"}}, \"metadata\": {\"name\": \"\", \"tags\": {\"language\": \"\"}, \"insightType\": \"\", \"insightMappingId\": \"\"}, \"data\": {\"clientId\": \"\", \"sessionId\": \"\", \"applicationName\": \"\", \"applicationVersion\": \"\", \"initialControlConnection\": \"\", \"controlConnection\": \"\", \"dataCenters\": [], \"localAddress\": \"\", \"executionProfiles\": {\"default\": {\"loadBalancing\": {\"type\": \"\", \"namespace\": \"\"}, \"speculativeExecution\": {\"type\": \"\", \"namespace\": \"\"}, \"consistency\": \"\", \"serialConsistency\": \"\", \"graphOptions\": {\"source\": \"\"}}}, \"compression\": \"\", \"reconnectionPolicy\": {\"type\": \"\", \"namespace\": \"\"}, \"authProvider\": {\"type\": \"\", \"namespace\": \"\"}, \"platformInfo\": {\"os\": {\"name\": \"\", \"version\": \"\", \"arch\": \"\"}, \"cpus\": {\"model\": \"\"}}, \"hostName\": \"\", \"driverName\": \"\", \"applicationNameWasGenerated\": \"\", \"driverVersion\": \"\"}}\"" + }, + { + "data": "2024-10-12T10:00:00Z cassandra-node-04 AUDIT MessageKey=corrupt_key Message=\"{unquoted_key: invalid_json}\"" + }, + { + "data": "INFO [AuditSync-1] 2024-10-12T10:00:00.123,456 AuditLogging.java:123 - user:dummy_user_01|authenticated:dummy_auth_01|host:/1.1.1.1|source:/1.1.1.6|operation:LOGIN Successful - user dummy_user_01 authenticated|type:LOGIN|category:AUTH|timestamp:1728727200000" + }, + { + "data": "INFO [AuditSync-2] 2024-10-12T10:00:00.456,789 AuditLogging.java:124 - user:dummy_user_02|host:/1.1.1.2|source:/1.1.1.7|operation:SELECT * FROM system_schema.keyspaces;|type:CQL_SELECT|category:DML|ks:system_schema|cf:keyspaces|consistency level:QUORUM|timestamp:1728727200000" + }, + { + "data": "INFO [AuditSync-3] 2024-10-12T10:00:00.789,123 AuditLogging.java:125 - user:dummy_user_03|host:/1.1.1.8|source:/1.1.1.9|operation:Batch statement execution [json='{\"batch_id\":\"b_1001\",\"statements_count\":5}']|type:BATCH|category:DML|timestamp:1728727200000" + }, + { + "data": "INFO [AuditSync-4] 2024-10-12T10:00:00.999,000 AuditLogging.java:126 - user:dummy_user_04|host:/2.2.2.1|source:/2.2.2.2|operation:Execute custom [json='invalid_json_data']|type:OTHER|category:ADMIN|timestamp:1728727200000" + }, + { + "data": "INFO [AuditSync-5] 2024-10-12T10:00:01.111,222 AuditLogging.java:127 - authenticated:dummy_auth_02|operation:ALTER ROLE dummy_auth_02 WITH SUPERUSER = true;|type:USER_CHANGE_PERMISSIONS|category:AUTH|timestamp:1728727200000" + }, + { + "data": "INFO [AuditSync-6] 2024-10-12T10:00:01.333,444 AuditLogging.java:128 - source:/2.2.2.3|operation:Node gossip status update|type:STATUS|category:SYSTEM|timestamp:1728727200000" + }, + { + "data": "2024-10-12T10:00:00Z cassandra-node-05 DEBUG MessageKey=access_key Message=\"{\"host\": {\"hostname\": \"target-cassandra-node\"}}\"" + }, + { + "data": "WARN [Native-Transport-Requests-1] 2024-10-12 10:00:00,123 StorageProxy.java:100 - Slow query detected , key partition_key_999, now 1728727200000" + }, + { + "data": "INFO [CompactionExecutor:1] 2024-10-12 10:00:00,456 QueryProcessor.java:200 - Compiling statement:\n\u003cSELECT * FROM test_keyspace.test_table WHERE id = 1;" + }, + { + "data": "INFO [AuditSync-7] 2024-10-12T10:00:01.555,666 AuditLogging.java:129 - host:invalid_host_no_slash|source:invalid_source_no_slash|user:dummy_user_05|timestamp:1728727200000" + } + ], + "type": "CASSANDRA" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/metadata.json b/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/metadata.json index 78cfa74b1e..5137c3cccb 100644 --- a/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/metadata.json @@ -5,5 +5,5 @@ "supported_format": "CSV,JSON", "category": "Secure Access Service Edge", "references": "https://inflight.dope.security/dope.console/settings/siem-integration#log-data-format", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..6a5b2374b7 --- /dev/null +++ b/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,413 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "policy_categories_values": [ + "Malware", + "Phishing" + ], + "request_processTree_values": [ + "Malware", + "Phishing" + ] + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "NETWORK_HTTP", + "logType": "DOPE_SWG", + "productName": "DOPE_SWG", + "productVersion": "1.0.0", + "vendorName": "DOPE_SWG" + }, + "network": { + "http": { + "userAgent": "HTTP/2.0" + }, + "receivedBytes": "8192", + "sentBytes": "4096" + }, + "principal": { + "asset": { + "assetId": "DS:agent_uuid_456", + "attribute": { + "cloud": { + "project": { + "id": "tenant_abc_123" + } + } + }, + "hostname": "workstation_alpha_01" + }, + "assetId": "DS:agent_uuid_456", + "hostname": "workstation_alpha_01", + "process": { + "commandLine": "browser_proc.exe" + }, + "user": { + "emailAddresses": [ + "dummy_user01@dummy.com" + ], + "userid": "user_sec_01" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "ruleName": "Block Malware", + "ruleType": "web_filtering" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.1" + ] + }, + "ip": [ + "1.1.1.1" + ], + "url": "https://secure.dummy.com/api/v1" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "policy_categories_values": [ + "101", + "102" + ] + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "DOPE_SWG", + "productName": "DOPE_SWG", + "productVersion": "1.0.0", + "vendorName": "DOPE_SWG" + }, + "network": { + "receivedBytes": "1024", + "sentBytes": "512" + }, + "securityResult": [ + { + "ruleName": "Audit Test", + "ruleType": "audit" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "DOPE_SWG", + "productName": "DOPE_SWG", + "productVersion": "1.0.0", + "vendorName": "DOPE_SWG" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:15:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:15:00Z", + "eventType": "NETWORK_CONNECTION", + "logType": "DOPE_SWG", + "productName": "DOPE_SWG", + "productVersion": "1.0.0", + "vendorName": "DOPE_SWG" + }, + "principal": { + "asset": { + "hostname": "workstation_beta_02" + }, + "hostname": "workstation_beta_02" + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "ruleName": "Allow Policy", + "ruleType": "dns_filtering" + } + ], + "target": { + "asset": { + "hostname": "target.dummy.com" + }, + "hostname": "target.dummy.com", + "url": "http://target.dummy.com/service" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:20:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:20:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "DOPE_SWG", + "productName": "DOPE_SWG", + "productVersion": "1.0.0", + "vendorName": "DOPE_SWG" + }, + "principal": { + "user": { + "userDisplayName": "Test User Display Name", + "userid": "user_gamma_03" + } + }, + "securityResult": [ + { + "action": [ + "CHALLENGE" + ], + "ruleName": "MFA Challenge Policy", + "ruleType": "auth_policy" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:25:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:25:00Z", + "eventType": "STATUS_UPDATE", + "logType": "DOPE_SWG", + "productName": "DOPE_SWG", + "productVersion": "1.0.0", + "vendorName": "DOPE_SWG" + }, + "principal": { + "asset": { + "assetId": "DS:agent_delta_04", + "attribute": { + "cloud": { + "project": { + "id": "tenant_delta_04" + } + } + }, + "hostname": "server_delta_04" + }, + "assetId": "DS:agent_delta_04", + "hostname": "server_delta_04" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:30:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:30:00Z", + "eventType": "NETWORK_HTTP", + "logType": "DOPE_SWG", + "productName": "SWG", + "vendorName": "Dope Security" + }, + "network": { + "receivedBytes": "2048", + "sentBytes": "1024" + }, + "principal": { + "asset": { + "assetId": "DS:agent_csv_01", + "hostname": "workstation_csv_01" + }, + "assetId": "DS:agent_csv_01", + "hostname": "workstation_csv_01", + "process": { + "file": { + "names": [ + "curl.exe" + ] + } + }, + "user": { + "accountType": "DOMAIN_ACCOUNT_TYPE", + "userid": "dummy_sso_user@dummy.com" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "Security_Malicious" + } + ], + "target": { + "asset": { + "hostname": "api.dummy.com", + "ip": [ + "1.1.1.2" + ] + }, + "file": { + "names": [ + "payload.exe" + ], + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + "hostname": "api.dummy.com", + "ip": [ + "1.1.1.2" + ], + "url": "https://api.dummy.com/download" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:35:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:35:00Z", + "eventType": "NETWORK_HTTP", + "logType": "DOPE_SWG", + "productName": "SWG", + "vendorName": "Dope Security" + }, + "principal": { + "asset": { + "assetId": "DS:agent_csv_02", + "hostname": "workstation_csv_02" + }, + "assetId": "DS:agent_csv_02", + "hostname": "workstation_csv_02", + "process": { + "file": { + "names": [ + "msedge.exe" + ] + } + }, + "user": { + "accountType": "LOCAL_ACCOUNT_TYPE", + "userid": "local_admin_02" + } + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "actionDetails": "Business_General" + } + ], + "target": { + "asset": { + "hostname": "portal.dummy.com", + "ip": [ + "1.1.1.3" + ] + }, + "hostname": "portal.dummy.com", + "ip": [ + "1.1.1.3" + ], + "url": "https://portal.dummy.com/home" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:40:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:40:00Z", + "eventType": "NETWORK_HTTP", + "logType": "DOPE_SWG", + "productName": "SWG", + "vendorName": "Dope Security" + }, + "principal": { + "asset": { + "assetId": "DS:agent_csv_03", + "hostname": "workstation_csv_03" + }, + "assetId": "DS:agent_csv_03", + "hostname": "workstation_csv_03", + "process": { + "file": { + "names": [ + "chrome.exe" + ] + } + }, + "user": { + "accountType": "DOMAIN_ACCOUNT_TYPE", + "userid": "dummy_sso_03@dummy.com" + } + }, + "securityResult": [ + { + "action": [ + "CHALLENGE" + ], + "actionDetails": "Authentication_2FA" + } + ], + "target": { + "asset": { + "hostname": "auth.dummy.com", + "ip": [ + "1.1.1.4" + ] + }, + "hostname": "auth.dummy.com", + "ip": [ + "1.1.1.4" + ], + "url": "https://auth.dummy.com/login" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..bcdc4f3003 --- /dev/null +++ b/content/parsers/third_party/community/DOPE_SWG_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,35 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"schemaVersion\":\"1.0.0\",\"timestamp\":\"2024-10-12T10:00:00Z\",\"destination\":{\"matchedDestination\":\"1.1.1.1\",\"url\":\"https://secure.dummy.com/api/v1\",\"destinationIP\":\"1.1.1.1\"},\"endpoint\":{\"tenantID\":\"tenant_abc_123\",\"agentID\":\"agent_uuid_456\",\"user\":\"user_sec_01\",\"deviceName\":\"workstation_alpha_01\",\"oidcUser\":\"dummy_user01@dummy.com\"},\"bandwidth\":{\"dataSentInBytes\":4096,\"dataReceivedInBytes\":8192},\"policy\":{\"verdict\":\"1\",\"policyType\":\"web_filtering\",\"policyName\":\"Block Malware\",\"categories\":[\"Malware\",\"Phishing\"]},\"request\":{\"duration\":150,\"httpVersion\":\"HTTP/2.0\",\"processName\":\"browser_proc.exe\",\"processTree\":\"root -\u003e parent -\u003e browser_proc.exe\"}}" + }, + { + "data": "{\"schemaVersion\":\"1.0.0\",\"timestamp\":\"invalid_iso8601_timestamp\",\"bandwidth\":{\"dataSentInBytes\":512,\"dataReceivedInBytes\":1024},\"policy\":{\"verdict\":\"99\",\"policyType\":\"audit\",\"policyName\":\"Audit Test\",\"categories\":[101,102]},\"request\":{\"duration\":200}}" + }, + { + "data": "{\"schemaVersion\":\"1.0.0\",\"timestamp\":\"\",\"destination\":{\"matchedDestination\":\"\",\"url\":\"\",\"destinationIP\":\"\"},\"endpoint\":{\"tenantID\":\"\",\"agentID\":\"\",\"user\":\"\",\"deviceName\":\"\",\"oidcUser\":\"\"},\"bandwidth\":{\"dataSentInBytes\":\"\",\"dataReceivedInBytes\":\"\"},\"policy\":{\"verdict\":\"\",\"policyType\":\"\",\"policyName\":\"\",\"categories\":\"\"},\"request\":{\"duration\":\"\",\"httpVersion\":\"\",\"processName\":\"\",\"processTree\":\"\"}}" + }, + { + "data": "{\"schemaVersion\":\"1.0.0\",\"timestamp\":\"2024-10-12T10:15:00Z\",\"destination\":{\"matchedDestination\":\"target.dummy.com\",\"url\":\"http://target.dummy.com/service\"},\"endpoint\":{\"deviceName\":\"workstation_beta_02\"},\"policy\":{\"verdict\":\"0\",\"policyType\":\"dns_filtering\",\"policyName\":\"Allow Policy\"}}" + }, + { + "data": "{\"schemaVersion\":\"1.0.0\",\"timestamp\":\"2024-10-12T10:20:00Z\",\"endpoint\":{\"user\":\"user_gamma_03\",\"oidcUser\":\"Test User Display Name\"},\"policy\":{\"verdict\":\"2\",\"policyType\":\"auth_policy\",\"policyName\":\"MFA Challenge Policy\"}}" + }, + { + "data": "{\"schemaVersion\":\"1.0.0\",\"timestamp\":\"2024-10-12T10:25:00Z\",\"endpoint\":{\"agentID\":\"agent_delta_04\",\"deviceName\":\"server_delta_04\",\"tenantID\":\"tenant_delta_04\"}}" + }, + { + "data": "2024-10-12T10:30:00Z,125,api.dummy.com,1.1.1.2,tenant_csv_01,agent_csv_01,dummy_user_01,dummy_sso_user@dummy.com,Security_Malicious,1,1024,2048,swg_policy,high_risk_domain,payload.exe,e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855,curl.exe,https://api.dummy.com/download,Default Block Policy,HTTPS,workstation_csv_01" + }, + { + "data": "2024-10-12T10:35:00Z,45,portal.dummy.com,1.1.1.3,tenant_csv_02,agent_csv_02,local_admin_02,,Business_General,0,0,0,standard_web,,,,msedge.exe,https://portal.dummy.com/home,Standard Allow Policy,HTTPS,workstation_csv_02" + }, + { + "data": "2024-10-12T10:40:00Z,80,auth.dummy.com,1.1.1.4,tenant_csv_03,agent_csv_03,dummy_user_03,dummy_sso_03@dummy.com,Authentication_2FA,2,,,mfa_auth,stepup_required,,,chrome.exe,https://auth.dummy.com/login,MFA Policy,HTTPS,workstation_csv_03" + } + ], + "type": "DOPE_SWG" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/ESET_IOC_GUS/cbn/metadata.json b/content/parsers/third_party/community/ESET_IOC_GUS/cbn/metadata.json index 8373950336..529888a6d9 100644 --- a/content/parsers/third_party/community/ESET_IOC_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/ESET_IOC_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "ESET_IOC", "supported_format": "JSON", "category": "IOC", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/ESET_IOC_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/ESET_IOC_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..873c9edf36 --- /dev/null +++ b/content/parsers/third_party/community/ESET_IOC_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,298 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "entity": { + "entity": { + "file": { + "md5": "44d88612fea8a8f36de82e1278abb02f" + }, + "hostname": "evil-threat.dummy.com", + "ip": [ + "1.1.1.1" + ], + "url": "https://evil-threat.dummy.com/malware/sample.exe" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:00:00.123456789Z", + "entityType": "IP_ADDRESS", + "interval": { + "endTime": "9999-12-31T23:59:59Z", + "startTime": "2024-05-20T12:00:00Z" + }, + "productName": "ESET_IOC", + "threat": [ + { + "category": [ + "NETWORK_MALICIOUS" + ], + "categoryDetails": [ + "Phishing", + "Win32/TrojanDropper.Agent.Sample", + "Exploit.CVE-2023-12345.Sample" + ], + "confidenceDetails": "90" + } + ], + "vendorName": "ESET_IOC" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "entity": { + "entity": { + "ip": [ + "1.1.1.3" + ] + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:00:00.123456789Z", + "entityType": "IP_ADDRESS", + "interval": { + "endTime": "9999-12-31T23:59:59Z", + "startTime": "2024-01-01T00:00:00Z" + }, + "productName": "ESET_IOC", + "threat": [ + { + "category": [ + "NETWORK_MALICIOUS" + ] + } + ], + "vendorName": "ESET_IOC" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "entity": { + "entity": { + "hostname": "ioc-threat-intel.dummy.com", + "ip": [ + "1.1.1.4" + ] + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:00:00.123456789Z", + "entityType": "IP_ADDRESS", + "interval": { + "endTime": "9999-12-31T23:59:59Z", + "startTime": "2024-06-01T15:00:00Z" + }, + "productName": "ESET_IOC", + "threat": [ + { + "category": [ + "NETWORK_MALICIOUS" + ], + "categoryDetails": [ + "Blocked", + "Win32/Trojan.IOC.Full", + "Exploit.IOC.Full" + ], + "confidenceDetails": "95" + } + ], + "vendorName": "ESET_IOC" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "entity": { + "entity": { + "hostname": "ioc-invalid-ip.example.net" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:00:00.123456789Z", + "entityType": "DOMAIN_NAME", + "interval": { + "endTime": "9999-12-31T23:59:59Z", + "startTime": "2024-07-01T10:00:00Z" + }, + "productName": "ESET_IOC", + "threat": [ + { + "category": [ + "NETWORK_MALICIOUS" + ], + "categoryDetails": [ + "Unwanted (PUA)", + "Win32/Unwanted.PUA" + ], + "confidenceDetails": "70" + } + ], + "vendorName": "ESET_IOC" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "entity": { + "entity": { + "hostname": "ioc-null-checks.example.org", + "ip": [ + "1.1.1.5" + ] + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:00:00.123456789Z", + "entityType": "IP_ADDRESS", + "interval": { + "endTime": "9999-12-31T23:59:59Z", + "startTime": "2024-08-10T18:00:00Z" + }, + "productName": "ESET_IOC", + "threat": [ + { + "category": [ + "NETWORK_MALICIOUS" + ], + "categoryDetails": [ + "Phishing" + ], + "confidenceDetails": "80" + } + ], + "vendorName": "ESET_IOC" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "entity": { + "entity": { + "ip": [ + "1.1.1.6" + ], + "url": "http://malicious-url-sample.example.org/gate.php" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:00:00.123456789Z", + "entityType": "IP_ADDRESS", + "interval": { + "endTime": "9999-12-31T23:59:59Z", + "startTime": "2024-09-01T11:22:33Z" + }, + "productName": "ESET_IOC", + "threat": [ + { + "category": [ + "NETWORK_MALICIOUS" + ], + "categoryDetails": [ + "Blocked", + "Trojan.WebInject", + "Exploit.WebInject" + ], + "confidenceDetails": "65" + } + ], + "vendorName": "ESET_IOC" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "entity": { + "entity": { + "file": { + "md5": "5d41402abc4b2a76b9719d911017c592" + }, + "ip": [ + "1.1.1.7" + ] + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:00:00.123456789Z", + "entityType": "IP_ADDRESS", + "interval": { + "endTime": "9999-12-31T23:59:59Z", + "startTime": "2024-10-15T08:30:00Z" + }, + "productName": "ESET_IOC", + "threat": [ + { + "category": [ + "NETWORK_MALICIOUS" + ], + "categoryDetails": [ + "Phishing", + "Win32/FileInfector.Test" + ], + "confidenceDetails": "55" + } + ], + "vendorName": "ESET_IOC" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "entity": { + "entity": { + "ip": [ + "1.1.1.8" + ] + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:00:00.123456789Z", + "entityType": "IP_ADDRESS", + "interval": { + "endTime": "9999-12-31T23:59:59Z", + "startTime": "2024-12-01T09:00:00Z" + }, + "productName": "ESET_IOC", + "threat": [ + { + "category": [ + "NETWORK_MALICIOUS" + ], + "categoryDetails": [ + "Blocked", + "Win32/Trojan.BothIPs" + ], + "confidenceDetails": "88" + } + ], + "vendorName": "ESET_IOC" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/ESET_IOC_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/ESET_IOC_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..ff4c5ff18a --- /dev/null +++ b/content/parsers/third_party/community/ESET_IOC_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,32 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"confidence\":\"90\",\"domain\":\"evil-threat.dummy.com\",\"downloaded_detection\":\"Win32/TrojanDropper.Agent.Sample\",\"ip\":\"1.1.1.1\",\"md5\":\"44d88612fea8a8f36de82e1278abb02f\",\"opener_detection\":\"Exploit.CVE-2023-12345.Sample\",\"state\":\"Phishing\",\"url\":\"https://evil-threat.dummy.com/malware/sample.exe\",\"valid_to\":\"2024-05-20 12:00:00 +0000\"}" + }, + { + "data": "{\"confidence\":\"\",\"domain\":\"1.1.1.3\",\"downloaded_detection\":\"\",\"ip\":\"\",\"md5\":\"\",\"opener_detection\":\"\",\"state\":\"\",\"url\":\"\",\"valid_to\":\"2024-01-01 00:00:00 +0000\"}" + }, + { + "data": "{\"confidence\":\"95\",\"domain\":\"ioc-threat-intel.dummy.com\",\"downloaded_detection\":\"Win32/Trojan.IOC.Full\",\"ip\":\"1.1.1.4\",\"md5\":\"\",\"opener_detection\":\"Exploit.IOC.Full\",\"state\":\"Blocked\",\"url\":\"\",\"valid_to\":\"2024-06-01 15:00:00 +0000\"}" + }, + { + "data": "{\"confidence\":\"70\",\"domain\":\"ioc-invalid-ip.example.net\",\"downloaded_detection\":\"Win32/Unwanted.PUA\",\"ip\":\"not-a-valid-ip-address\",\"md5\":\"\",\"opener_detection\":\"\",\"state\":\"Unwanted (PUA)\",\"url\":\"\",\"valid_to\":\"2024-07-01 10:00:00 +0000\"}" + }, + { + "data": "{\"confidence\":\"80\",\"domain\":\"ioc-null-checks.example.org\",\"downloaded_detection\":\"null\",\"ip\":\"1.1.1.5\",\"md5\":\"\",\"opener_detection\":\"null\",\"state\":\"Phishing\",\"url\":\"\",\"valid_to\":\"2024-08-10 18:00:00 +0000\"}" + }, + { + "data": "{\"confidence\":\"65\",\"domain\":\"\",\"downloaded_detection\":\"Trojan.WebInject\",\"ip\":\"1.1.1.6\",\"md5\":\"\",\"opener_detection\":\"Exploit.WebInject\",\"state\":\"Blocked\",\"url\":\"http://malicious-url-sample.example.org/gate.php\",\"valid_to\":\"2024-09-01 11:22:33 +0000\"}" + }, + { + "data": "{\"confidence\":\"55\",\"domain\":\"1.1.1.7\",\"downloaded_detection\":\"Win32/FileInfector.Test\",\"ip\":\"\",\"md5\":\"5d41402abc4b2a76b9719d911017c592\",\"opener_detection\":\"\",\"state\":\"Phishing\",\"url\":\"\",\"valid_to\":\"2024-10-15 08:30:00 +0000\"}" + }, + { + "data": "{\"confidence\":\"88\",\"domain\":\"1.1.1.8\",\"downloaded_detection\":\"Win32/Trojan.BothIPs\",\"ip\":\"1.1.1.9\",\"md5\":\"\",\"opener_detection\":\"\",\"state\":\"Blocked\",\"url\":\"\",\"valid_to\":\"2024-12-01 09:00:00 +0000\"}" + } + ], + "type": "ESET_IOC" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/IBM_CICS_GUS/cbn/metadata.json b/content/parsers/third_party/community/IBM_CICS_GUS/cbn/metadata.json index 97aacbef93..6c209214c8 100644 --- a/content/parsers/third_party/community/IBM_CICS_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/IBM_CICS_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "IBM", "supported_format": "LEEF", "category": "Service Bus", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/IBM_CICS_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/IBM_CICS_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..14e4cc2d7b --- /dev/null +++ b/content/parsers/third_party/community/IBM_CICS_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,193 @@ +{ + "events": [ + { + "event": { + "timestamp": "2023-05-18T14:32:10.5Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Transaction execution completed successfully", + "eventTimestamp": "2023-05-18T14:32:10.500Z", + "eventType": "PROCESS_UNCATEGORIZED", + "logType": "IBM_CICS", + "productEventType": "TRANSACTION_EXECUTION", + "productName": "CICS", + "productVersion": "5.4", + "vendorName": "IBM" + }, + "principal": { + "asset": { + "hostname": "TERM01", + "ip": [ + "1.1.1.1" + ] + }, + "hostname": "TERM01", + "ip": [ + "1.1.1.1" + ], + "user": { + "firstName": "dummy_fname", + "lastName": "dummy_lname", + "userDisplayName": "dummy_lname, dummy_fname", + "userid": "dummy_user_01" + } + }, + "target": { + "application": "CICS_APP_01", + "process": { + "productSpecificProcessId": "tran:TRN1" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2023-05-18T15:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "User authenticated", + "eventTimestamp": "2023-05-18T15:00:00Z", + "eventType": "PROCESS_UNCATEGORIZED", + "logType": "IBM_CICS", + "productEventType": "USER_AUTHENTICATION", + "productName": "CICS", + "productVersion": "5.4", + "vendorName": "IBM" + }, + "principal": { + "asset": { + "hostname": "TERM02", + "ip": [ + "1.1.1.2" + ] + }, + "hostname": "TERM02", + "ip": [ + "1.1.1.2" + ], + "user": { + "userDisplayName": "dummy_single_user", + "userid": "dummy_user_02" + } + }, + "target": { + "application": "CICS_APP_02", + "process": { + "productSpecificProcessId": "tran:AUTH" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2023-05-18T16:15:30.123Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "System status check", + "eventTimestamp": "2023-05-18T16:15:30.123Z", + "eventType": "GENERIC_EVENT", + "logType": "IBM_CICS", + "productEventType": "SYSTEM_STATUS", + "productName": "CICS", + "productVersion": "6.1", + "vendorName": "IBM" + }, + "principal": { + "user": { + "userid": "dummy_user_03" + } + }, + "target": { + "application": "CICS_SYS", + "process": { + "productSpecificProcessId": "tran:STAT" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2023-05-18T18:20:00.123Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Resource access granted", + "eventTimestamp": "2023-05-18T18:20:00.123Z", + "eventType": "PROCESS_UNCATEGORIZED", + "logType": "IBM_CICS", + "productEventType": "RESOURCE_ACCESS", + "productName": "CICS", + "productVersion": "5.4", + "vendorName": "IBM" + }, + "principal": { + "asset": { + "hostname": "TERM03" + }, + "hostname": "TERM03", + "user": { + "userid": "dummy_user_05" + } + }, + "target": { + "application": "CICS_RES", + "process": { + "productSpecificProcessId": "tran:RES1" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2023-05-18T19:45:00.999Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Configuration updated", + "eventTimestamp": "2023-05-18T19:45:00.999Z", + "eventType": "PROCESS_UNCATEGORIZED", + "logType": "IBM_CICS", + "productEventType": "CONFIG_UPDATE", + "productName": "CICS", + "productVersion": "6.1", + "vendorName": "IBM" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.4" + ] + }, + "ip": [ + "1.1.1.4" + ], + "user": { + "firstName": "dummy_admin_first", + "lastName": "dummy_admin_last", + "userDisplayName": "dummy_admin_last, dummy_admin_first", + "userid": "dummy_admin_01" + } + }, + "target": { + "application": "CICS_CFG", + "process": { + "productSpecificProcessId": "tran:CFG1" + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/IBM_CICS_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/IBM_CICS_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..ddeda6c848 --- /dev/null +++ b/content/parsers/third_party/community/IBM_CICS_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,23 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "LEEF:1.0|IBM|CICS|5.4|TRANSACTION_EXECUTION|devTime=2023-05-18T14:32:10.500+0000\tusrName=dummy_user_01\tname=dummy_lname, dummy_fname\tterminal=TERM01\tsrc=1.1.1.1\tappl=CICS_APP_01\ttran=TRN1\tsum=Transaction execution completed successfully" + }, + { + "data": "LEEF:1.0|IBM|CICS|5.4|USER_AUTHENTICATION|devTime=2023-05-18T15:00:00.000+0000\tusrName=dummy_user_02\tname=dummy_single_user\tterminal=TERM02\tsrc=1.1.1.2\tappl=CICS_APP_02\ttran=AUTH\tsum=User authenticated" + }, + { + "data": "LEEF:2.0|IBM|CICS|6.1|SYSTEM_STATUS|devTime=2023-05-18T16:15:30.123+0000\tusrName=dummy_user_03\tappl=CICS_SYS\ttran=STAT\tsum=System status check" + }, + { + "data": "LEEF:2.0|IBM|CICS|5.4|RESOURCE_ACCESS|devTime=2023-05-18T18:20:00.123+0000·usrName=dummy_user_05·terminal=TERM03·appl=CICS_RES·tran=RES1·sum=Resource access granted" + }, + { + "data": "LEEF:1.0|IBM|CICS|6.1|CONFIG_UPDATE|devTime=2023-05-18T19:45:00.999+0000\tusrName=dummy_admin_01\tname=dummy_admin_last, dummy_admin_first\tsrc=1.1.1.4\tappl=CICS_CFG\ttran=CFG1\tsum=Configuration updated" + } + ], + "type": "IBM_CICS" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/metadata.json b/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/metadata.json index 362bc38082..dd26aec849 100644 --- a/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "JUNIPER", "supported_format": "SYSLOG + KV", "category": "IDS/IPS", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..44b6d9cf19 --- /dev/null +++ b/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,262 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "intermediary": [ + { + "application": "HTTP", + "hostname": "srx-router-01" + } + ], + "metadata": { + "description": "IDP Attack log generated for attack", + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "NETWORK_CONNECTION", + "logType": "JUNIPER_IPS", + "productEventType": "RT_IDP-IDP_ATTACK_LOG_EVENT", + "productName": "JUNIPER_IPS", + "productVersion": "junos@2636.1.1.1.1.39", + "vendorName": "JUNIPER" + }, + "network": { + "ipProtocol": "TCP", + "receivedBytes": "1500", + "sentBytes": "3200" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.2" + ] + }, + "ip": [ + "1.1.1.2" + ], + "port": 49152, + "user": { + "userDisplayName": "user_01" + } + }, + "securityResult": [ + { + "category": [ + "NETWORK_SUSPICIOUS" + ], + "description": "SQL Injection attempt detected in query string", + "ruleName": "rule_idp_block_01", + "severity": "HIGH", + "threatName": "HTTP:SQL-INJECTION" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.3" + ] + }, + "ip": [ + "1.1.1.3" + ], + "port": 80 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "JUNIPER_IPS", + "productEventType": "RT_FLOW-RT_FLOW_SESSION_CLOSE", + "productName": "JUNIPER_IPS", + "productVersion": "junos@2636.1.1.1.1.39", + "vendorName": "JUNIPER" + }, + "principal": { + "asset": { + "hostname": "srx-router-02", + "ip": [ + "1.1.1.4" + ] + }, + "hostname": "srx-router-02", + "ip": [ + "1.1.1.4" + ], + "port": 50123 + }, + "target": { + "asset": { + "ip": [ + "1.1.1.5" + ] + }, + "ip": [ + "1.1.1.5" + ], + "port": 443 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "policy-name": "policy_allow_web", + "service-name": "junos-ssl" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "NETWORK_CONNECTION", + "logType": "JUNIPER_IPS", + "productEventType": "RT_NAT-RT_NAT_POOL_EXHAUSTED", + "productName": "JUNIPER_IPS", + "productVersion": "junos@2636.1.1.1.1.39", + "vendorName": "JUNIPER" + }, + "network": { + "receivedBytes": "1048576", + "sentBytes": "2097152" + }, + "principal": { + "asset": { + "hostname": "srx-router-03", + "ip": [ + "1.1.1.7" + ] + }, + "hostname": "srx-router-03", + "ip": [ + "1.1.1.7" + ], + "port": 34567 + }, + "securityResult": [ + { + "actionDetails": "Session closed normally", + "ruleName": "nat_pool_rule_01", + "ruleType": "source-nat" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.6" + ] + }, + "ip": [ + "1.1.1.6" + ], + "location": { + "name": "zone_trust" + }, + "port": 8080 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "intermediary": [ + { + "application": "SCAN", + "hostname": "srx-router-04" + } + ], + "metadata": { + "description": "IDP Attack log generated for attack", + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "JUNIPER_IPS", + "productEventType": "RT_IDP-IDP_ATTACK_LOG_EVENT", + "productName": "JUNIPER_IPS", + "productVersion": "junos@2636.1.1.1.1.39", + "vendorName": "JUNIPER" + }, + "network": { + "ipProtocol": "TCP", + "receivedBytes": "100", + "sentBytes": "200" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.8" + ] + }, + "ip": [ + "1.1.1.8" + ], + "port": 49153, + "user": { + "userDisplayName": "user_02" + } + }, + "securityResult": [ + { + "category": [ + "NETWORK_SUSPICIOUS" + ], + "description": "Port scan detected", + "ruleName": "rule_idp_monitor_02", + "severity": "LOW", + "threatName": "SCAN:PORT-SCAN" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.9" + ] + }, + "ip": [ + "1.1.1.9" + ], + "port": 8080 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "JUNIPER_IPS", + "productEventType": "RT_FLOW-RT_FLOW_SESSION_UNKNOWN", + "productName": "JUNIPER_IPS", + "productVersion": "junos@2636.1.1.1.1.39", + "vendorName": "JUNIPER" + }, + "principal": { + "asset": { + "hostname": "srx-router-05" + }, + "hostname": "srx-router-05" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..296148ad07 --- /dev/null +++ b/content/parsers/third_party/community/JUNIPER_IPS_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,23 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "\u003c14\u003e1 2024-10-12T10:00:00.000Z srx-router-01 RT_IDP - IDP_ATTACK_LOG_EVENT [junos@2636.1.1.1.1.39 epoch-time=\"1728727200\" threat-severity=\"HIGH\" rule-name=\"rule_idp_block_01\" attack-name=\"HTTP:SQL-INJECTION\" message=\"SQL Injection attempt detected in query string\" source-address=\"1.1.1.2\" source-port=\"49152\" username=\"user_01\" destination-address=\"1.1.1.3\" destination-port=\"80\" application-name=\"HTTP\" protocol-name=\"TCP\" inbound-bytes=\"1500\" outbound-bytes=\"3200\" service-name=\"junos-http\"]" + }, + { + "data": "\u003c14\u003e1 2024-10-12T10:00:00.000Z srx-router-02 RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.1.39 source-address=\"1.1.1.4\" source-port=\"50123\" destination-address=\"1.1.1.5\" destination-port=\"443\" bytes-from-client=\"invalid_rcvd_bytes\" bytes-from-server=\"invalid_sent_bytes\"]" + }, + { + "data": "\u003c14\u003e1 2024-10-12T10:00:00.000Z srx-router-03 RT_NAT - RT_NAT_POOL_EXHAUSTED [junos@2636.1.1.1.1.39 reflexive-ip=\"1.1.1.6\" internal-ip=\"1.1.1.7\" reflexive-port=\"8080\" internal-port=\"34567\" bytes-from-client=\"1048576\" bytes-from-server=\"2097152\" source-zone-name=\"zone_trust\" policy-name=\"policy_allow_web\" service-name=\"junos-ssl\" src-nat-rule-type=\"source-nat\" src-nat-rule-name=\"nat_pool_rule_01\" reason=\"Session closed normally\"]" + }, + { + "data": "\u003c14\u003e1 2024-10-12T10:00:00.000Z srx-router-04 RT_IDP - IDP_ATTACK_LOG_EVENT [junos@2636.1.1.1.1.39 threat-severity=\"INFORMATIONAL\" rule-name=\"rule_idp_monitor_02\" attack-name=\"SCAN:PORT-SCAN\" message=\"Port scan detected\" source-address=\"1.1.1.8\" source-port=\"49153\" username=\"user_02\" destination-address=\"1.1.1.9\" destination-port=\"8080\" application-name=\"SCAN\" protocol-name=\"TCP\" inbound-bytes=\"100\" outbound-bytes=\"200\"]" + }, + { + "data": "\u003c14\u003e1 2024-10-12T10:00:00.000Z srx-router-05 RT_FLOW - RT_FLOW_SESSION_UNKNOWN [junos@2636.1.1.1.1.39 session-id=\"12345\"]" + } + ], + "type": "JUNIPER_IPS" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/KISI_GUS/cbn/metadata.json b/content/parsers/third_party/community/KISI_GUS/cbn/metadata.json index 60e13f6096..5522ccfbc8 100644 --- a/content/parsers/third_party/community/KISI_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/KISI_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "KISI", "supported_format": "JSON", "category": "Physical Security", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/KISI_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/KISI_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..817bf2393d --- /dev/null +++ b/content/parsers/third_party/community/KISI_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,353 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "KISI", + "productLogId": "1001", + "productName": "KISI", + "vendorName": "KISI" + }, + "principal": { + "resource": { + "attribute": { + "labels": [ + { + "key": "object_type", + "value": "Door" + } + ] + }, + "name": "Main Entrance", + "productObjectId": "3001" + }, + "user": { + "attribute": { + "roles": [ + { + "name": "Admin" + } + ] + }, + "emailAddresses": [ + "test_user_01@dummy.com" + ], + "productObjectId": "2001", + "userid": "test_user_01" + } + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "description": "test_user_01 unlocked Main Entrance (test_user_01@dummy.com)", + "detectionFields": [ + { + "key": "error_code", + "value": "0" + }, + { + "key": "code", + "value": "access_granted" + }, + { + "key": "success", + "value": "true" + } + ], + "summary": "No error" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:05:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:05:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "KISI", + "productName": "KISI", + "vendorName": "KISI" + }, + "principal": { + "resource": { + "attribute": { + "labels": [ + { + "key": "object_type", + "value": "Lock" + } + ] + }, + "name": "Back Door" + }, + "user": { + "attribute": { + "roles": [ + { + "name": "User" + } + ] + }, + "userid": "test_user_02" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "description": "Direct message without any parentheses", + "detectionFields": [ + { + "key": "error_code", + "value": "1" + }, + { + "key": "code", + "value": "door_locked" + } + ], + "summary": "Locking completed" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "KISI", + "productName": "KISI", + "vendorName": "KISI" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:15:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:15:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "KISI", + "productLogId": "1005", + "productName": "KISI", + "vendorName": "KISI" + }, + "principal": { + "resource": { + "attribute": { + "labels": [ + { + "key": "object_type", + "value": "Gate" + } + ] + }, + "name": "Side Gate", + "productObjectId": "3005" + }, + "user": { + "attribute": { + "roles": [ + { + "name": "Member" + } + ] + }, + "productObjectId": "2005", + "userid": "test_user_05" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "description": "test_user_05 locked Side Gate (invalid_email_no_at_symbol)", + "detectionFields": [ + { + "key": "error_code", + "value": "ERR_403" + }, + { + "key": "code", + "value": "access_denied" + }, + { + "key": "success", + "value": "false" + } + ], + "summary": "Access denied to side gate" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:20:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:20:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "KISI", + "productLogId": "1006", + "productName": "KISI", + "vendorName": "KISI" + }, + "principal": { + "resource": { + "attribute": { + "labels": [ + { + "key": "object_type", + "value": "ServerLock" + } + ] + }, + "name": "Server Room", + "productObjectId": "3006" + }, + "user": { + "attribute": { + "roles": [ + { + "name": "Security" + } + ] + }, + "emailAddresses": [ + "test_user_06@dummy.com" + ], + "productObjectId": "2006", + "userid": "test_user_06" + } + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "description": "test_user_06 unlocked Server Room (test_user_06@dummy.com)", + "detectionFields": [ + { + "key": "error_code", + "value": "0" + }, + { + "key": "code", + "value": "card_authenticated" + }, + { + "key": "success", + "value": "true" + } + ], + "summary": "Authentication success" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:25:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:25:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "KISI", + "productLogId": "1007", + "productName": "KISI", + "vendorName": "KISI" + }, + "principal": { + "resource": { + "attribute": { + "labels": [ + { + "key": "object_type", + "value": "Turnstile" + } + ] + }, + "name": "Turnstile A", + "productObjectId": "3007" + }, + "user": { + "emailAddresses": [ + "test_user_07@dummy.com" + ] + } + }, + "securityResult": [ + { + "description": "Badge scanned (test_user_07@dummy.com)" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:30:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:30:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "KISI", + "productLogId": "1008", + "productName": "KISI", + "vendorName": "KISI" + }, + "principal": { + "resource": { + "productObjectId": "3008" + }, + "user": { + "productObjectId": "2008", + "userid": "test_user_08" + } + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ] + } + ] + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/KISI_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/KISI_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..c5c4358154 --- /dev/null +++ b/content/parsers/third_party/community/KISI_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,29 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"event\":{\"id\":1001,\"actor_id\":2001,\"actor_name\":\"test_user_01\",\"actor_type\":\"Admin\",\"action\":\"unlock\",\"object_id\":3001,\"object_name\":\"Main Entrance\",\"object_type\":\"Door\",\"success\":true,\"error_code\":\"0\",\"error_message\":\"No error\",\"code\":\"access_granted\",\"message\":\"test_user_01 unlocked Main Entrance (test_user_01@dummy.com)\",\"created_at\":\"2024-10-12T10:00:00Z\"}}" + }, + { + "data": "{\"event\":{\"id\":{},\"actor_id\":{},\"actor_name\":\"test_user_02\",\"actor_type\":\"User\",\"action\":\"lock\",\"object_id\":{},\"object_name\":\"Back Door\",\"object_type\":\"Lock\",\"success\":{},\"error_code\":\"1\",\"error_message\":\"Locking completed\",\"code\":\"door_locked\",\"message\":\"Direct message without any parentheses\",\"created_at\":\"2024-10-12T10:05:00Z\"}}" + }, + { + "data": "{\"event\":{\"id\":\"\",\"actor_id\":\"\",\"actor_name\":\"\",\"actor_type\":\"\",\"action\":\"\",\"object_id\":\"\",\"object_name\":\"\",\"object_type\":\"\",\"success\":\"\",\"error_code\":\"\",\"error_message\":\"\",\"code\":\"\",\"message\":\"\",\"created_at\":\"\",\"anchor_tag\":\"test_anchor_empty\"}}" + }, + { + "data": "{\"event\":{\"id\":1005,\"actor_id\":2005,\"actor_name\":\"test_user_05\",\"actor_type\":\"Member\",\"action\":\"locked\",\"object_id\":3005,\"object_name\":\"Side Gate\",\"object_type\":\"Gate\",\"success\":false,\"error_code\":\"ERR_403\",\"error_message\":\"Access denied to side gate\",\"code\":\"access_denied\",\"message\":\"test_user_05 locked Side Gate (invalid_email_no_at_symbol)\",\"created_at\":\"2024-10-12T10:15:00Z\"}}" + }, + { + "data": "{\"event\":{\"id\":1006,\"actor_id\":2006,\"actor_name\":\"test_user_06\",\"actor_type\":\"Security\",\"action\":\"unlocked\",\"object_id\":3006,\"object_name\":\"Server Room\",\"object_type\":\"ServerLock\",\"success\":true,\"error_code\":\"0\",\"error_message\":\"Authentication success\",\"code\":\"card_authenticated\",\"message\":\"test_user_06 unlocked Server Room (test_user_06@dummy.com)\",\"created_at\":\"2024-10-12T10:20:00Z\"}}" + }, + { + "data": "{\"event\":{\"id\":1007,\"action\":\"scan_badge\",\"object_id\":3007,\"object_name\":\"Turnstile A\",\"object_type\":\"Turnstile\",\"message\":\"Badge scanned (test_user_07@dummy.com)\",\"created_at\":\"2024-10-12T10:25:00Z\"}}" + }, + { + "data": "{\"event\":{\"id\":1008,\"actor_id\":2008,\"actor_name\":\"test_user_08\",\"action\":\"unlock\",\"object_id\":3008,\"created_at\":\"2024-10-12T10:30:00Z\"}}" + } + ], + "type": "KISI" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/STACKHAWK_GUS/cbn/metadata.json b/content/parsers/third_party/community/STACKHAWK_GUS/cbn/metadata.json index 700074d915..2efc76d91a 100644 --- a/content/parsers/third_party/community/STACKHAWK_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/STACKHAWK_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "STACKHAWK", "supported_format": "JSON", "category": "Vulnerability scanners", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/STACKHAWK_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/STACKHAWK_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..231627fc26 --- /dev/null +++ b/content/parsers/third_party/community/STACKHAWK_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,136 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "STACKHAWK", + "productLogId": "hawk_log_empty_003" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "Application": "payment_gateway_app", + "Status": "RUNNING", + "Timestamp": "2024-10-12T10:05:00Z", + "msgEnv": "staging", + "msgId": "scan_start_005", + "name_0": "build_id", + "name_1": "branch", + "orgId": "org_uuid_005", + "scanVersion": "v2.5.0", + "service": "hawkscan_service", + "value_0": "b_9988", + "value_1": "main" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:01:40Z", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "STACKHAWK", + "productLogId": "hawk_log_scan_started_005" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.2" + ] + }, + "ip": [ + "1.1.1.2" + ], + "url": "https://app.dummy.internal/scans/005", + "user": { + "userDisplayName": "dummy_user_005" + } + }, + "target": { + "user": { + "emailAddresses": [ + "user_005@dummy.com" + ] + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "Application": "inventory_api", + "Status": "INITIALIZING", + "Timestamp": "2024-10-12T10:15:00Z", + "msgEnv": "qa", + "msgId": "root_scan_start_007", + "name_0": "cluster", + "orgId": "org_uuid_007", + "scanVersion": "v3.0.1", + "service": "root_scan_daemon", + "value_0": "qa_cluster_01" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:03:20Z", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "STACKHAWK", + "productLogId": "hawk_log_root_start_007" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.3" + ] + }, + "ip": [ + "1.1.1.3" + ], + "url": "https://app.dummy.internal/scans/root_007", + "user": { + "userDisplayName": "dummy_user_007", + "userid": "user_uuid_007" + } + }, + "target": { + "user": { + "emailAddresses": [ + "user_007@dummy.com" + ] + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "collectedTimestamp": "2024-10-12T10:05:00Z", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "STACKHAWK", + "productLogId": "hawk_log_minimal_008" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/STACKHAWK_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/STACKHAWK_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..7a198a8568 --- /dev/null +++ b/content/parsers/third_party/community/STACKHAWK_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,20 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"id\": \"hawk_log_empty_003\", \"timestamp\": \"\", \"userIPAddr\": \"\", \"organizationId\": \"\", \"userId\": \"\", \"userName\": \"\", \"userEmail\": \"\", \"appId\": \"\", \"appName\": \"\", \"scanId\": \"\", \"triageNote\": \"\", \"envId\": \"\", \"pathsCount\": \"\", \"triageStatus\": \"\", \"userExternalId\": \"\", \"apiSource\": \"\", \"userProvider\": \"\", \"service\": \"\", \"msg\": {\"service\": \"\", \"scanStarted\": {\"scan\": {\"id\": \"\", \"hawkscanVersion\": \"\", \"env\": \"\", \"status\": \"\", \"application\": \"\", \"startedTimestamp\": \"\", \"scanURL\": \"\", \"tags\": []}}, \"scanCompleted\": {\"scan\": {\"id\": \"\", \"hawkscanVersion\": \"\", \"env\": \"\", \"status\": \"\", \"application\": \"\", \"startedTimestamp\": \"\", \"scanURL\": \"\", \"tags\": []}, \"findings\": []}}, \"scanStarted\": {\"scan\": {\"id\": \"\", \"hawkscanVersion\": \"\", \"env\": \"\", \"status\": \"\", \"application\": \"\", \"startedTimestamp\": \"\", \"scanURL\": \"\", \"tags\": []}}, \"scanCompleted\": {\"scan\": {\"id\": \"\", \"hawkscanVersion\": \"\", \"env\": \"\", \"status\": \"\", \"application\": \"\", \"startedTimestamp\": \"\", \"scanURL\": \"\", \"tags\": []}, \"findings\": []}}" + }, + { + "data": "{\"id\": \"hawk_log_scan_started_005\", \"timestamp\": 1728727300000, \"userIPAddr\": \"1.1.1.2\", \"organizationId\": \"org_uuid_005\", \"has_principal\": \"true\", \"userName\": \"dummy_user_005\", \"userEmail\": \"user_005@dummy.com\", \"msg\": {\"service\": \"hawkscan_service\", \"scanStarted\": {\"scan\": {\"id\": \"scan_start_005\", \"hawkscanVersion\": \"v2.5.0\", \"env\": \"staging\", \"status\": \"RUNNING\", \"application\": \"payment_gateway_app\", \"startedTimestamp\": \"2024-10-12T10:05:00Z\", \"scanURL\": \"https://app.dummy.internal/scans/005\", \"tags\": [{\"name\": \"build_id\", \"value\": \"b_9988\"}, {\"name\": \"branch\", \"value\": \"main\"}]}}}}" + }, + { + "data": "{\"id\": \"hawk_log_root_start_007\", \"timestamp\": 1728727400000, \"userIPAddr\": \"1.1.1.3\", \"organizationId\": \"org_uuid_007\", \"userId\": \"user_uuid_007\", \"userName\": \"dummy_user_007\", \"userEmail\": \"user_007@dummy.com\", \"service\": \"root_scan_daemon\", \"scanStarted\": {\"scan\": {\"id\": \"root_scan_start_007\", \"hawkscanVersion\": \"v3.0.1\", \"env\": \"qa\", \"status\": \"INITIALIZING\", \"application\": \"inventory_api\", \"startedTimestamp\": \"2024-10-12T10:15:00Z\", \"scanURL\": \"https://app.dummy.internal/scans/root_007\", \"tags\": [{\"name\": \"cluster\", \"value\": \"qa_cluster_01\"}]}}}" + }, + { + "data": "{\"id\": \"hawk_log_minimal_008\", \"timestamp\": 1728727500000}" + } + ], + "type": "STACKHAWK" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/metadata.json b/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/metadata.json index e5b296ddc5..b91549c5ef 100644 --- a/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "TERADATA", "supported_format": "SYSLOGgcert", "category": "Database log types", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..66ecedaee3 --- /dev/null +++ b/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,604 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T04:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "collect_timestamp": "2024-10-12T04:30:00Z", + "logon_date_time": "2024-10-12T04:30:00Z", + "logon_details_value": "details", + "logon_source": "TCP LSS", + "protocol_value": "TCP", + "remote_hostname_value": "host01.corp.internal", + "request_mode": "MODE_BATCH", + "statement_group": "DML", + "statement_type": "SELECT", + "teradata_port": "1025" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T04:30:00Z", + "eventTimestamp": "2024-10-12T04:30:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "TERADATA_DB", + "productName": "TERADATA_DB", + "vendorName": "TERADATA" + }, + "network": { + "http": { + "responseCode": 200 + }, + "sessionId": "98765" + }, + "principal": { + "asset": { + "hostname": "tdnode01", + "ip": [ + "1.1.1.2" + ] + }, + "hostname": "tdnode01", + "ip": [ + "1.1.1.2" + ], + "user": { + "groupid": "DML", + "userDisplayName": "dummy_user_01", + "userid": "1001" + } + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "statement_type_value", + "value": "SELECT" + } + ] + }, + "detectionFields": [ + { + "key": "error_code", + "value": "200" + } + ], + "summary": "No error" + } + ], + "target": { + "asset": { + "assetId": "CLIENT_ID:client_guid_123", + "productObjectId": "app_client_01" + }, + "assetId": "CLIENT_ID:client_guid_123", + "process": { + "commandLine": "SELECT * FROM sales_data;" + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "profile_name_value", + "value": "prof_admin" + } + ] + }, + "id": "12345", + "name": "sales_db", + "parent": "TCP LSS 1.1.1.1 host01.corp.internal 1025 app01 user01 details", + "productObjectId": "granularity_high", + "resourceSubtype": "MODE_BATCH", + "resourceType": "DATABASE" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T04:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "cid_value": "cid_4567", + "collect_timestamp": "2024-10-12 04:30:00", + "connection_id_value": "CONN_999", + "jdbc_driver_info_value": "Teradata_JDBC_Driver_17.10", + "logon_date_time": "2024-10-12 04:30:00", + "logon_details_value": "LSS jdbc connection established", + "logon_source": "CONN_999 1.1.1.3 info_session;dbclient02.corp.internal/1.1.1.3:1025 CID=cid_4567 opt_tag Teradata_JDBC_Driver_17.10 LSS", + "remote_hostname_value": "dbclient02.corp.internal", + "request_mode": "MODE_INTERACTIVE", + "statement_group": "DML", + "statement_type": "INSERT", + "teradata_port": "1025" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T04:30:00Z", + "eventTimestamp": "2024-10-12T04:30:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "TERADATA_DB", + "productName": "TERADATA_DB", + "vendorName": "TERADATA" + }, + "network": { + "http": { + "responseCode": 3706 + }, + "sessionId": "88888" + }, + "principal": { + "asset": { + "hostname": "tdnode02", + "ip": [ + "1.1.1.4" + ] + }, + "hostname": "tdnode02", + "ip": [ + "1.1.1.4" + ], + "user": { + "groupid": "DML", + "userDisplayName": "dummy_user_02", + "userid": "1002" + } + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "statement_type_value", + "value": "INSERT" + } + ] + }, + "detectionFields": [ + { + "key": "error_code", + "value": "3706" + } + ], + "summary": "Syntax error in query" + } + ], + "target": { + "asset": { + "assetId": "CLIENT_ID:client_987", + "productObjectId": "bteq_tool" + }, + "assetId": "CLIENT_ID:client_987", + "process": { + "commandLine": "INSERT INTO finance_records VALUES (1, 2);" + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "profile_name_value", + "value": "prof_finance" + } + ] + }, + "id": "67890", + "name": "finance_db", + "parent": "CONN_999 1.1.1.3 info_session;dbclient02.corp.internal/1.1.1.3:1025 CID=cid_4567 opt_tag Teradata_JDBC_Driver_17.10 LSS jdbc connection established", + "productObjectId": "granularity_medium", + "resourceSubtype": "MODE_INTERACTIVE", + "resourceType": "DATABASE" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T04:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "collect_timestamp": "2024-10-12T04:30:00+00:00", + "logon_date_time": "2024-10-12T04:30:00Z", + "logon_details_value": "details", + "logon_source": "CLI LSS", + "protocol_value": "CLI", + "remote_hostname_value": "dbclient03.corp.internal", + "request_mode": "MODE_AUTO", + "statement_group": "SESSION", + "statement_type": "LOGON", + "teradata_port": "1025" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T04:30:00Z", + "eventTimestamp": "2024-10-12T04:30:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "TERADATA_DB", + "productName": "TERADATA_DB", + "vendorName": "TERADATA" + }, + "network": { + "sessionId": "77777" + }, + "principal": { + "asset": { + "hostname": "tdnode03", + "ip": [ + "1.1.1.6" + ] + }, + "hostname": "tdnode03", + "ip": [ + "1.1.1.6" + ], + "user": { + "groupid": "SESSION", + "userDisplayName": "dummy_user_03", + "userid": "1003" + } + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "statement_type_value", + "value": "LOGON" + } + ] + }, + "detectionFields": [ + { + "key": "error_code", + "value": "0" + } + ], + "summary": "Success" + } + ], + "target": { + "asset": { + "assetId": "CLIENT_ID:client03", + "productObjectId": "app03" + }, + "assetId": "CLIENT_ID:client03", + "process": { + "commandLine": ".LOGON tdnode03/dummy_user_03" + }, + "resource": { + "id": "54321", + "name": "hr_db", + "parent": "CLI LSS 1.1.1.5 dbclient03.corp.internal 1025 app03 user03 details", + "productObjectId": "granularity_low", + "resourceSubtype": "MODE_AUTO", + "resourceType": "DATABASE" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T04:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "collect_timestamp": "2024-10-12T04:30:00Z", + "logon_date_time": "2024-10-12T04:30:00Z", + "logon_details_value": "details", + "logon_source": "CLI LSS", + "protocol_value": "CLI", + "remote_hostname_value": "dbclient04.corp.internal", + "request_mode": "MODE_AUTO", + "statement_group": "SESSION", + "statement_type": "LOGOFF", + "teradata_port": "1025" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T04:30:00Z", + "eventTimestamp": "2024-10-12T04:30:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "TERADATA_DB", + "productName": "TERADATA_DB", + "vendorName": "TERADATA" + }, + "network": { + "sessionId": "66666" + }, + "principal": { + "asset": { + "hostname": "tdnode04", + "ip": [ + "1.1.1.8" + ] + }, + "hostname": "tdnode04", + "ip": [ + "1.1.1.8" + ], + "user": { + "groupid": "SESSION", + "userDisplayName": "dummy_user_04", + "userid": "1004" + } + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "statement_type_value", + "value": "LOGOFF" + } + ] + }, + "detectionFields": [ + { + "key": "error_code", + "value": "null" + } + ], + "summary": "User logged off" + } + ], + "target": { + "asset": { + "assetId": "CLIENT_ID:client04", + "productObjectId": "app04" + }, + "assetId": "CLIENT_ID:client04", + "process": { + "commandLine": ".LOGOFF" + }, + "resource": { + "id": "proc_888", + "name": "hr_db", + "parent": "CLI LSS 1.1.1.7 dbclient04.corp.internal 1025 app04 user04 details", + "productObjectId": "granularity_low", + "resourceSubtype": "MODE_AUTO", + "resourceType": "DATABASE" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T04:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "collect_timestamp": "2024-10-12T04:30:00Z", + "logon_date_time": "2024-10-12T04:30:00Z", + "logon_details_value": "details", + "logon_source": "CLI LSS", + "protocol_value": "CLI", + "remote_hostname_value": "dbclient06.corp.internal", + "request_mode": "MODE_SYSTEM", + "statement_group": "ADMIN", + "statement_type": "CHECK", + "teradata_port": "1025" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T04:30:00Z", + "eventTimestamp": "2024-10-12T04:30:00Z", + "eventType": "STATUS_UPDATE", + "logType": "TERADATA_DB", + "productName": "TERADATA_DB", + "vendorName": "TERADATA" + }, + "network": { + "http": { + "responseCode": 200 + }, + "sessionId": "44444" + }, + "principal": { + "asset": { + "hostname": "tdnode06", + "ip": [ + "2.2.2.2" + ] + }, + "hostname": "tdnode06", + "ip": [ + "2.2.2.2" + ], + "user": { + "groupid": "ADMIN" + } + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "statement_type_value", + "value": "CHECK" + } + ] + }, + "detectionFields": [ + { + "key": "error_code", + "value": "200" + } + ], + "summary": "Health check ok" + } + ], + "target": { + "asset": { + "assetId": "CLIENT_ID:client06", + "productObjectId": "app06" + }, + "assetId": "CLIENT_ID:client06", + "process": { + "commandLine": "CHECK SYSTEM STATUS;" + }, + "resource": { + "id": "22222", + "name": "system_db", + "parent": "CLI LSS 2.2.2.1 dbclient06.corp.internal 1025 app06 user06 details", + "productObjectId": "granularity_low", + "resourceSubtype": "MODE_SYSTEM", + "resourceType": "DATABASE" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T04:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "collect_timestamp": "2024-10-12T04:30:00Z", + "logon_date_time": "2024-10-12T04:30:00Z" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T04:30:00Z", + "eventTimestamp": "2024-10-12T04:30:00Z", + "eventType": "GENERIC_EVENT", + "logType": "TERADATA_DB", + "productName": "TERADATA_DB", + "vendorName": "TERADATA" + }, + "network": { + "sessionId": "33333" + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "error_code", + "value": "0" + } + ], + "summary": "No error" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T04:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "collect_timestamp": "2024-10-12T04:30:00Z", + "logon_date_time": "2024-10-12T04:30:00Z", + "logon_details_value": "details", + "logon_source": "TCP LSS", + "protocol_value": "TCP", + "remote_hostname_value": "host08.corp.internal", + "request_mode": "MODE_INTERACTIVE", + "statement_group": "DDL", + "statement_type": "CREATE", + "teradata_port": "1025" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T04:30:00Z", + "eventTimestamp": "2024-10-12T04:30:00Z", + "eventType": "USER_RESOURCE_ACCESS", + "logType": "TERADATA_DB", + "productName": "TERADATA_DB", + "vendorName": "TERADATA" + }, + "network": { + "sessionId": "22222" + }, + "principal": { + "asset": { + "hostname": "tdnode08", + "ip": [ + "2.2.2.4" + ] + }, + "hostname": "tdnode08", + "ip": [ + "2.2.2.4" + ], + "user": { + "groupid": "DDL", + "userDisplayName": "dummy_user_08", + "userid": "1008" + } + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "statement_type_value", + "value": "CREATE" + } + ] + }, + "detectionFields": [ + { + "key": "error_code", + "value": "0" + } + ], + "summary": "Success" + } + ], + "target": { + "asset": { + "assetId": "CLIENT_ID:client08", + "productObjectId": "app08" + }, + "assetId": "CLIENT_ID:client08", + "process": { + "commandLine": "CREATE TABLE dev_test (id INT);" + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "profile_name_value", + "value": "prof_dev" + } + ] + }, + "id": "33333", + "name": "dev_db", + "parent": "TCP LSS 2.2.2.3 host08.corp.internal 1025 app08 user08 details", + "productObjectId": "granularity_default", + "resourceSubtype": "MODE_INTERACTIVE", + "resourceType": "DATABASE" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "TERADATA_DB", + "productName": "TERADATA_DB", + "vendorName": "TERADATA" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..1e93366f4a --- /dev/null +++ b/content/parsers/third_party/community/TERADATA_DB_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,32 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "\u003c134\u003eOct 12 04:30:00 tdnode01 prof_admin|12345|2024-10-12T04:30:00Z|1001|dummy_user_01|sales_db|98765|2024-10-12T04:30:00Z|HDR TCP LSS 1.1.1.1 host01.corp.internal 1025 app01 user01 details|app_client_01 |client_guid_123 |1.1.1.2 |200|No error|SELECT |DML|SELECT * FROM sales_data;|MODE_BATCH |granularity_high" + }, + { + "data": "Oct 12 04:30:00 tdnode02 prof_finance|67890|2024-10-12 04:30:00|1002|dummy_user_02|finance_db|88888|2024-10-12 04:30:00|CONN_999 1.1.1.3 info_session;dbclient02.corp.internal/1.1.1.3:1025 CID=cid_4567 opt_tag Teradata_JDBC_Driver_17.10 LSS jdbc connection established|bteq_tool|client_987|1.1.1.4 |3706|Syntax error in query|INSERT|DML|INSERT INTO finance_records VALUES (1, 2);|MODE_INTERACTIVE|granularity_medium" + }, + { + "data": "Oct 12 04:30:00 tdnode03 |54321|2024-10-12T04:30:00+00:00|1003|dummy_user_03|hr_db|77777|2024-10-12T04:30:00Z|CLI LSS 1.1.1.5 dbclient03.corp.internal 1025 app03 user03 details|app03|client03|1.1.1.6 |0|Success|LOGON|SESSION|.LOGON tdnode03/dummy_user_03|MODE_AUTO|granularity_low" + }, + { + "data": "Oct 12 04:30:00 tdnode04 proc_888|2024-10-12T04:30:00Z|1004|dummy_user_04|hr_db|66666|2024-10-12T04:30:00Z|CLI LSS 1.1.1.7 dbclient04.corp.internal 1025 app04 user04 details|app04|client04|1.1.1.8 |null|User logged off|LOGOFF|SESSION|.LOGOFF|MODE_AUTO|granularity_low" + }, + { + "data": "Oct 12 04:30:00 tdnode06 |22222|2024-10-12T04:30:00Z|||system_db|44444|2024-10-12T04:30:00Z|CLI LSS 2.2.2.1 dbclient06.corp.internal 1025 app06 user06 details|app06|client06|2.2.2.2 |200|Health check ok|CHECK|ADMIN|CHECK SYSTEM STATUS;|MODE_SYSTEM|granularity_low" + }, + { + "data": "|2024-10-12T04:30:00Z||||33333|2024-10-12T04:30:00Z||||NONE |0|No error|||||" + }, + { + "data": "\u003c134\u003eOct 12 04:30:00 tdnode08 prof_dev\"|\"33333\"|\"2024-10-12T04:30:00Z\"|\"1008\"|\"dummy_user_08\"|\"dev_db\"|\"22222\"|\"2024-10-12T04:30:00Z\"|\"HDR TCP LSS 2.2.2.3 host08.corp.internal 1025 app08 user08 details\"|\"app08 \"|\"client08 \"|\"2.2.2.4 \"|\"0\"|\"Success\"|\"CREATE \"|\"DDL\"|\"CREATE TABLE dev_test (id INT);\"|\"MODE_INTERACTIVE \"|\"granularity_default" + }, + { + "data": "Oct 12 04:30:00 tdnode10 |99999|2024-10-12T04:30:00Z||||2024-10-12T04:30:00Z|||| ||||||" + } + ], + "type": "TERADATA_DB" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/UBERAGENT_GUS/cbn/metadata.json b/content/parsers/third_party/community/UBERAGENT_GUS/cbn/metadata.json index 36faad8083..4e23d3fa14 100644 --- a/content/parsers/third_party/community/UBERAGENT_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/UBERAGENT_GUS/cbn/metadata.json @@ -5,5 +5,5 @@ "supported_format": "CSV", "category": "Security", "references": "https://docs.citrix.com/en-us/uberagent/7-2-1/metrics/session", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/UBERAGENT_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/UBERAGENT_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..6b648febe0 --- /dev/null +++ b/content/parsers/third_party/community/UBERAGENT_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,474 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "AdDomainDns": "corp.dummy.com", + "AdDomainNetBios": "CORP", + "AdOu": "OU=Servers,DC=corp,DC=example,DC=com", + "AdSite": "Default-First-Site", + "BaseboardSerial": "MB-SERIAL-112233", + "CPUCoresLogical": "8", + "CPUMaxMhz": "3200", + "CPUSockets": "1", + "ComputerNameCanonical": "corp.dummy.com/Servers/srv-01", + "ComputerNameDn": "CN=srv-01,OU=Servers,DC=corp,DC=example,DC=com", + "CtxDeliveryGroupName": "DeliveryGroup_Prod", + "CtxFarmName": "Farm_Alpha", + "CtxMachineCatalogName": "Catalog_VDI_Win10", + "HwBiosVersion": "v2.4.0", + "HwHypervisorVendor": "Citrix Hypervisor", + "HwIsVirtualMachine": "1", + "IsBatteryPresent": "0", + "IsUpsPresent": "0", + "OsBuild": "19044", + "OsInstallDate": "2023-01-15 10:30:00", + "OsName": "Microsoft Windows 10 Enterprise", + "OsSpName": "Service Pack 1", + "OsType": "Windows", + "OsUpdateBuildRevision": "1288", + "PowerSupportsConnectedStandby": "0", + "PowerSupportsS1": "1", + "PowerSupportsS2": "1", + "PowerSupportsS3": "1", + "PowerSupportsS4": "1", + "PowerSupportsS5": "1", + "SessionAppStateCtx": "Foreground", + "SessionBrokerDnsVmw": "broker.corp.dummy.com", + "SessionBrokerDomainVmw": "brokerdomain.dummy.com", + "SessionBrokerTunnelUrlVmw": "https://gateway.corp.dummy.com", + "SessionBrokerTunneledVmw": "true", + "SessionBrokerType": "VMware Horizon", + "SessionBrokerUrlVmw": "https://broker.corp.dummy.com/desktop", + "SessionCPUTimeMs": "15320", + "SessionCPUUsagePercent": "12.5", + "SessionClientName": "client-workstation-01", + "SessionClientOsLanguage": "en-US", + "SessionClientTimezoneVmw": "UTC+01:00", + "SessionClientTypeCtx": "Citrix Receiver", + "SessionConnectionState": "Active", + "SessionEncryptionCtx": "AES-256", + "SessionIOCount": "1200", + "SessionIOLatencyMs": "2.1", + "SessionIOMB": "34.8", + "SessionIOPS": "45.2", + "SessionNetKBPS": "128.4", + "SessionProcessCount": "42", + "SessionProtocol": "HDX", + "SessionPublishedAppsCtx": "Notepad,Excel", + "SessionPublishedName": "Desktop Prod", + "SessionTransportProtocols": "UDP", + "SessionTypeVmw": "VDI", + "SessionWorkingSetMB": "450.5", + "Sourcetype": "uberAgent:Session:SessionDetail", + "data_stream dataset": "uberagent.session", + "data_stream namespace": "corp_namespace", + "data_stream subset": "user_metrics", + "data_stream type": "logs", + "logstash_pipeline": "main_uberagent_pipeline", + "tags": [ + "tag_env_prod", + "tag_sec_mon" + ], + "uberagent_index_name": "idx_uberagent_prod" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "UBERAGENT", + "productLogId": "d3b07384-d113-40e1-9234-9cf9e51c8901", + "productName": "UBERAGENT", + "vendorName": "UBERAGENT" + }, + "network": { + "http": { + "parsedUserAgent": { + "annotation": [ + { + "key": "Chrome", + "value": "Chrome/1.1.1.2" + }, + { + "key": "SafariType", + "value": "Safari/537.36" + }, + { + "key": "OS_NAME", + "value": "Windows NT" + }, + { + "key": "OS_VERSION", + "value": "10.0" + }, + { + "key": "misc", + "value": "x64" + } + ], + "browser": "Chrome", + "browserEngineVersion": "537.36", + "browserType": "BROWSER_TYPE_CHROME", + "browserVariantType": "BROWSER_VARIANT_TYPE_UNKNOWN", + "browserVersion": "1.1.1.2", + "device": "x64", + "family": "APPLEWEBKIT", + "os": "Windows NT 10.0", + "osType": "OS_TYPE_WINDOWS", + "osVariant": "Win64", + "osVariantType": "OS_VARIANT_TYPE_UNKNOWN", + "platform": "Windows", + "subFamily": "AppleWebKit" + }, + "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.2 Safari/537.36" + }, + "ipProtocol": "UDP", + "sessionId": "sess_ks_1001" + }, + "principal": { + "administrativeDomain": "clientuserdomain.dummy.com", + "asset": { + "hardware": [ + { + "cpuModel": "Acme V-Core Processor @ 3.2GHz", + "cpuNumberCores": "4", + "cpuPlatform": "x64", + "manufacturer": "Acme Hardware Corp", + "model": "Enterprise Server Pro 5000", + "ram": "16", + "serialNumber": "BIOS-SN-998877" + } + ], + "hostname": "srv_uberagent_01", + "ip": [ + "1.1.1.3", + "1.1.1.1" + ], + "mac": [ + "00:11:22:33:44:55" + ] + }, + "hostname": "srv_uberagent_01", + "ip": [ + "1.1.1.3", + "1.1.1.1" + ], + "mac": [ + "00:11:22:33:44:55" + ], + "platform": "WINDOWS", + "platformVersion": "10.0.19044", + "user": { + "userDisplayName": "dummy_user_01" + } + }, + "target": { + "asset": { + "ip": [ + "1.1.1.4" + ] + }, + "ip": [ + "1.1.1.4" + ], + "url": "https://portal.dummy.com/session/1001", + "user": { + "userDisplayName": "broker_admin_01", + "userid": "client_uid_5544" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "CPUCoresLogical": "8", + "CPUSockets": "2", + "OsUpdateBuildRevision": "100" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "UBERAGENT", + "productName": "UBERAGENT", + "vendorName": "UBERAGENT" + }, + "network": { + "http": { + "parsedUserAgent": { + "annotation": [ + { + "key": "OS_NAME", + "value": "UnknownArch" + } + ], + "device": "InvalidUAString", + "deviceVersion": "999.999", + "family": "USER_DEFINED", + "os": "UnknownArch", + "osType": "OS_TYPE_UNKNOWN", + "osVariantType": "OS_VARIANT_TYPE_UNKNOWN", + "platform": "UnknownOS" + }, + "userAgent": "InvalidUAString/999.999 (UnknownOS; UnknownArch)" + }, + "sessionId": "sess_err_test_02" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "SessionTransportProtocols": "TCP" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "UBERAGENT", + "productName": "UBERAGENT", + "vendorName": "UBERAGENT" + }, + "network": { + "ipProtocol": "TCP" + }, + "principal": { + "asset": { + "hostname": "anchor_server_03" + }, + "hostname": "anchor_server_03", + "user": { + "userDisplayName": "user_session_03" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "SessionAppStateCtx": "Active", + "SessionBrokerDnsVmw": "broker.local", + "SessionBrokerDomainVmw": "brokerdom.local", + "SessionBrokerTunnelUrlVmw": "https://tunnel.local", + "SessionBrokerTunneledVmw": "false", + "SessionBrokerType": "Citrix DaaS", + "SessionBrokerUrlVmw": "https://broker.local", + "SessionCPUTimeMs": "8500", + "SessionCPUUsagePercent": "15.0", + "SessionClientHwIdCtx2": "HW-CSV-100", + "SessionClientName": "csv-client-01", + "SessionClientOsLanguage": "en-US", + "SessionClientTimezoneVmw": "UTC", + "SessionClientTypeCtx": "Workspace App", + "SessionColorDepth": "24", + "SessionConnectionState": "Active", + "SessionEncryptionCtx": "TLS 1.3", + "SessionFgAppId": "appid_csv_1", + "SessionFgAppVersion": "2.0.0", + "SessionFgBrowserActiveTabHost": "finance.corp", + "SessionFgBrowserType": "Edge", + "SessionFgProcessId": "8812", + "SessionFgProcessName": "finance.exe", + "SessionFgWindowTitle": "Quarterly Report", + "SessionFps": "30", + "SessionHRes": "1920", + "SessionIOCount": "400", + "SessionIOLatencyMs": "3.5", + "SessionIOMB": "12.4", + "SessionIOPS": "30.5", + "SessionNetKBPS": "75.0", + "SessionProcessCount": "25", + "SessionProtocol": "HDX", + "SessionPublishedAppsCtx": "Excel", + "SessionPublishedName": "Finance App", + "SessionRoundTripTimeMs": "20", + "SessionRpLatencyMs2": "12.0", + "SessionTransportProtocols": "UDP", + "SessionTypeVmw": "RDS", + "SessionVRes": "1080", + "SessionWorkingSetMB": "350.0" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "UBERAGENT", + "productLogId": "guid-csv-9999", + "productName": "UBERAGENT", + "vendorName": "UBERAGENT" + }, + "network": { + "ipProtocol": "UDP" + }, + "principal": { + "administrativeDomain": "csvuserdomain.dummy.com", + "asset": { + "hostname": "csvdomain.dummy.com", + "ip": [ + "1.1.1.5" + ], + "mac": [ + "00:22:44:66:88:aa" + ] + }, + "hostname": "csvdomain.dummy.com", + "ip": [ + "1.1.1.5" + ], + "mac": [ + "00:22:44:66:88:aa" + ], + "platform": "WINDOWS", + "platformVersion": "Windows 10.0.22000", + "user": { + "userDisplayName": "csv_client_user_01" + } + }, + "target": { + "asset": { + "ip": [ + "1.1.1.6" + ] + }, + "ip": [ + "1.1.1.6" + ], + "user": { + "userDisplayName": "broker_mgr_01", + "userid": "client_uid_8877" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "UBERAGENT", + "productName": "UBERAGENT", + "vendorName": "UBERAGENT" + }, + "principal": { + "asset": { + "hostname": "csv-hostname-srv", + "ip": [ + "1.1.1.7" + ] + }, + "hostname": "csv-hostname-srv", + "ip": [ + "1.1.1.7" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "UBERAGENT", + "productName": "UBERAGENT", + "vendorName": "UBERAGENT" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "SessionTransportProtocols": "TCP" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "UBERAGENT", + "productName": "UBERAGENT", + "vendorName": "UBERAGENT" + }, + "network": { + "ipProtocol": "TCP", + "sessionId": "sess_sys_08" + }, + "principal": { + "administrativeDomain": "sysuserdomain.dummy.com", + "asset": { + "hostname": "sysdomain.dummy.com", + "ip": [ + "1.1.1.8" + ], + "mac": [ + "00:aa:bb:cc:dd:ee" + ] + }, + "hostname": "sysdomain.dummy.com", + "ip": [ + "1.1.1.8" + ], + "mac": [ + "00:aa:bb:cc:dd:ee" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "Sourcetype": "uberAgent:Session:GenericEvent", + "logstash_pipeline": "pipeline_generic", + "uberagent_index_name": "idx_generic" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "UBERAGENT", + "productName": "UBERAGENT", + "vendorName": "UBERAGENT" + }, + "network": { + "sessionId": "sess_generic_09" + }, + "target": { + "url": "https://api.dummy.com/v1/status" + } + } + } + } + } + ] +} diff --git a/content/parsers/third_party/community/UBERAGENT_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/UBERAGENT_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..0ed90bc054 --- /dev/null +++ b/content/parsers/third_party/community/UBERAGENT_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,32 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"@timestamp\": \"2024-10-12T08:00:00.000Z\", \"SessionID\": \"sess_ks_1001\", \"system_ip\": \"1.1.1.1\", \"host\": \"srv_uberagent_01\", \"url_path\": \"https://portal.dummy.com/session/1001\", \"Sourcetype\": \"uberAgent:Session:SessionDetail\", \"tags\": [\"tag_env_prod\", \"tag_sec_mon\"], \"user_agent\": {\"original\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.2 Safari/537.36\"}, \"data_stream\": {\"namespace\": \"corp_namespace\", \"subset\": \"user_metrics\", \"dataset\": \"uberagent.session\", \"type\": \"logs\"}, \"logstash_pipeline\": \"main_uberagent_pipeline\", \"uberagent_index_name\": \"idx_uberagent_prod\", \"HwManufacturer\": \"Acme Hardware Corp\", \"PowerSupportsS1\": 1, \"PowerSupportsS2\": 1, \"PowerSupportsS3\": 1, \"PowerSupportsS4\": 1, \"PowerSupportsS5\": 1, \"IsUpsPresent\": 0, \"CPUCoresLogical\": 8, \"CPUCoresPhysical\": 4, \"RAMSizeGB\": 16, \"CPUName\": \"Acme V-Core Processor @ 3.2GHz\", \"OsArchitecture\": \"x64\", \"BIOSSerial\": \"BIOS-SN-998877\", \"HwModel\": \"Enterprise Server Pro 5000\", \"AdOu\": \"OU=Servers,DC=corp,DC=example,DC=com\", \"PowerSupportsConnectedStandby\": 0, \"IsBatteryPresent\": 0, \"CPUMaxMhz\": 3200, \"BaseboardSerial\": \"MB-SERIAL-112233\", \"CtxDeliveryGroupName\": \"DeliveryGroup_Prod\", \"CtxFarmName\": \"Farm_Alpha\", \"CtxMachineCatalogName\": \"Catalog_VDI_Win10\", \"HwBiosVersion\": \"v2.4.0\", \"HwHypervisorVendor\": \"Citrix Hypervisor\", \"HwIsVirtualMachine\": 1, \"OsBuild\": 19044, \"OsInstallDate\": \"2023-01-15 10:30:00\", \"OsName\": \"Microsoft Windows 10 Enterprise\", \"OsType\": \"Windows\", \"OsUpdateBuildRevision\": 1288, \"AdDomainNetBios\": \"CORP\", \"AdSite\": \"Default-First-Site\", \"ComputerNameCanonical\": \"corp.dummy.com/Servers/srv-01\", \"ComputerNameDn\": \"CN=srv-01,OU=Servers,DC=corp,DC=example,DC=com\", \"CPUSockets\": 1, \"OsSpName\": \"Service Pack 1\", \"AdDomainDns\": \"corp.dummy.com\", \"OsVersion\": \"10.0.19044\", \"SessionProtocol\": \"HDX\", \"SessionConnectionState\": \"Active\", \"SessionProcessCount\": 42, \"SessionCPUTimeMs\": 15320, \"SessionCPUUsagePercent\": 12.5, \"SessionIOPS\": 45.2, \"SessionIOCount\": 1200, \"SessionIOMB\": 34.8, \"SessionIOLatencyMs\": 2.1, \"SessionWorkingSetMB\": 450.5, \"SessionUser\": \"user_session_01\", \"SessionNetKBPS\": 128.4, \"SessionGUID\": \"d3b07384-d113-40e1-9234-9cf9e51c8901\", \"SessionRpLatencyMs2\": 15.4, \"SessionClientMac\": \"00-11-22-33-44-55\", \"SessionClientIp\": \"1.1.1.3\", \"SessionClientName\": \"client-workstation-01\", \"SessionClientDomain\": \"clientdomain.dummy.com\", \"SessionClientUser\": \"dummy_user_01\", \"SessionClientUserDomain\": \"clientuserdomain.dummy.com\", \"SessionHRes\": 1920, \"SessionVRes\": 1080, \"SessionColorDepth\": 32, \"SessionClientPlatform\": \"Windows 10 Pro\", \"SessionClientVersion\": \"Windows 10.0.19044\", \"SessionClientOsLanguage\": \"en-US\", \"SessionPublishedName\": \"Desktop Prod\", \"SessionPublishedAppsCtx\": \"Notepad,Excel\", \"SessionAppStateCtx\": \"Foreground\", \"SessionEncryptionCtx\": \"AES-256\", \"SessionClientTypeCtx\": \"Citrix Receiver\", \"SessionBrokerDnsVmw\": \"broker.corp.dummy.com\", \"SessionBrokerUrlVmw\": \"https://broker.corp.dummy.com/desktop\", \"SessionBrokerTunneledVmw\": \"true\", \"SessionBrokerTunnelUrlVmw\": \"https://gateway.corp.dummy.com\", \"SessionBrokerRemoteIpVmw\": \"1.1.1.4\", \"SessionBrokerUserVmw\": \"broker_admin_01\", \"SessionBrokerDomainVmw\": \"brokerdomain.dummy.com\", \"SessionClientTimezoneVmw\": \"UTC+01:00\", \"SessionClientIdVmw\": \"client_uid_5544\", \"SessionTypeVmw\": \"VDI\", \"SessionBrokerType\": \"VMware Horizon\", \"SessionFgAppId\": \"app_id_9901\", \"SessionFgAppVersion\": \"1.5.2\", \"SessionFgProcessName\": \"app_process.exe\", \"SessionFgProcessId\": \"5432\", \"SessionFgBrowserType\": \"Chrome\", \"SessionFgBrowserActiveTabHost\": \"app.internal.dummy.com\", \"SessionFgWindowTitle\": \"Main Dashboard - Portal\", \"SessionClientHwIdCtx2\": \"HWID-ABC-123\", \"SessionRoundTripTimeMs\": \"18\", \"SessionFps\": \"60\", \"SessionTransportProtocols\": \"UDP\"}" + }, + { + "data": "{\"SessionID\": \"sess_err_test_02\", \"RAMSizeGB\": \"invalid_ram_integer\", \"user_agent\": {\"original\": \"InvalidUAString/999.999 (UnknownOS; UnknownArch)\"}, \"CPUCoresLogical\": \"8\", \"CPUSockets\": \"2\", \"OsUpdateBuildRevision\": \"100\"}" + }, + { + "data": "{\"host\": \"anchor_server_03\", \"SessionUser\": \"user_session_03\", \"SessionTransportProtocols\": \"TCP\", \"SessionClientPlatform\": \"Linux\", \"SessionClientVersion\": \"5.15.0-generic\", \"SessionBrokerRemoteIpVmw\": \"\", \"SessionClientUser\": \"\", \"SessionClientIp\": \"\", \"system_ip\": \"\", \"SessionClientMac\": \"\", \"SessionClientDomain\": \"\", \"SessionClientUserDomain\": \"\", \"SessionProtocol\": \"\", \"SessionProcessCount\": \"\", \"SessionIOMB\": \"\", \"SessionGUID\": \"\", \"url_path\": \"\", \"SessionClientTypeCtx\": \"\", \"SessionCPUTimeMs\": \"\", \"SessionAppStateCtx\": \"\", \"SessionPublishedAppsCtx\": \"\", \"SessionConnectionState\": \"\", \"SessionClientIdVmw\": \"\", \"SessionBrokerUserVmw\": \"\", \"SessionIOCount\": \"\", \"SessionBrokerDomainVmw\": \"\", \"SessionBrokerType\": \"\", \"SessionPublishedName\": \"\", \"SessionNetKBPS\": \"\", \"SessionWorkingSetMB\": \"\", \"SessionBrokerDnsVmw\": \"\", \"SessionBrokerUrlVmw\": \"\", \"SessionBrokerTunneledVmw\": \"\", \"SessionBrokerTunnelUrlVmw\": \"\", \"SessionClientTimezoneVmw\": \"\", \"SessionCPUUsagePercent\": \"\", \"SessionIOPS\": \"\", \"SessionClientName\": \"\", \"SessionEncryptionCtx\": \"\", \"SessionIOLatencyMs\": \"\", \"PowerSupportsS3\": \"\", \"IsBatteryPresent\": \"\", \"PowerSupportsS1\": \"\", \"PowerSupportsS2\": \"\", \"PowerSupportsS5\": \"\", \"CPUMaxMhz\": \"\", \"BaseboardSerial\": \"\", \"CtxMachineCatalogName\": \"\", \"AdDomainDns\": \"\", \"HwHypervisorVendor\": \"\", \"OsBuild\": \"\", \"HwBiosVersion\": \"\", \"PowerSupportsS4\": \"\", \"HwIsVirtualMachine\": \"\", \"IsUpsPresent\": \"\", \"PowerSupportsConnectedStandby\": \"\", \"SessionClientOsLanguage\": \"\", \"SessionTypeVmw\": \"\", \"OsInstallDate\": \"\", \"Sourcetype\": \"\", \"uberagent_index_name\": \"\", \"data_stream\": {\"namespace\": \"\", \"dataset\": \"\", \"type\": \"\", \"subset\": \"\"}, \"CPUCoresLogical\": \"\", \"AdOu\": \"\", \"AdDomainNetBios\": \"\", \"logstash_pipeline\": \"\", \"AdSite\": \"\", \"CtxFarmName\": \"\", \"CPUSockets\": \"\", \"OsSpName\": \"\", \"OsName\": \"\", \"OsType\": \"\", \"OsUpdateBuildRevision\": \"\", \"ComputerNameCanonical\": \"\", \"ComputerNameDn\": \"\", \"CtxDeliveryGroupName\": \"\", \"tags\": [], \"user_agent\": {\"original\": \"\"}, \"SessionID\": \"\", \"CPUName\": \"\", \"HwManufacturer\": \"\", \"OsArchitecture\": \"\", \"BIOSSerial\": \"\", \"HwModel\": \"\", \"token_hardware\": \"\", \"OsVersion\": \"\"}" + }, + { + "data": "uberagent,7.2,2024-10-12T08:00:00.0000000+00:00 +00:00,HDX,Active,25,8500,15.0,30.5,400,12.4,3.5,350.0,75.0,csv_user_01,guid-csv-9999,12.0,00-22-44-66-88-AA,1.1.1.5,csv-client-01,csvdomain.dummy.com,csv_client_user_01,csvuserdomain.dummy.com,1920,1080,24,Windows 11,Windows 10.0.22000,en-US,Finance App,Excel,Active,TLS 1.3,Workspace App,broker.local,https://broker.local,false,https://tunnel.local,1.1.1.6,broker_mgr_01,brokerdom.local,UTC,client_uid_8877,RDS,Citrix DaaS,appid_csv_1,2.0.0,finance.exe,8812,Edge,finance.corp,Quarterly Report,HW-CSV-100,20,30,UDP" + }, + { + "data": "uberagent,7.2,not_a_valid_timestamp,val4,csv-hostname-srv,val6,val7,1.1.1.7" + }, + { + "data": "uberagent,7.2,invalid_time,col4,,col6,col7,not_an_ip" + }, + { + "data": "{\"system_ip\": \"1.1.1.8\", \"SessionClientMac\": \"00-AA-BB-CC-DD-EE\", \"SessionClientDomain\": \"sysdomain.dummy.com\", \"SessionClientUserDomain\": \"sysuserdomain.dummy.com\", \"SessionTransportProtocols\": \"TCP\", \"SessionID\": \"sess_sys_08\"}" + }, + { + "data": "{\"url_path\": \"https://api.dummy.com/v1/status\", \"SessionID\": \"sess_generic_09\", \"Sourcetype\": \"uberAgent:Session:GenericEvent\", \"logstash_pipeline\": \"pipeline_generic\", \"uberagent_index_name\": \"idx_generic\"}" + } + ], + "type": "UBERAGENT" + } +}