From 88ea3451229f325da40353e89813650288534885 Mon Sep 17 00:00:00 2001 From: shridhar-stack Date: Wed, 26 Aug 2026 10:27:27 +0000 Subject: [PATCH] [b/551874614] Migration of IBM_SECURITY_VERIFY_SAAS logtype from Piper workspace to github --- .../cbn/default_ibm_security_verify_saas.conf | 870 ++++++++++++++++++ .../cbn/metadata.json | 8 + .../expected_events/default_events.json | 462 ++++++++++ .../cbn/testdata/raw_logs/default_log.json | 35 + 4 files changed, 1375 insertions(+) create mode 100644 content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/default_ibm_security_verify_saas.conf create mode 100644 content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/metadata.json create mode 100644 content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/testdata/expected_events/default_events.json create mode 100644 content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/testdata/raw_logs/default_log.json diff --git a/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/default_ibm_security_verify_saas.conf b/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/default_ibm_security_verify_saas.conf new file mode 100644 index 0000000000..e7a1307dc5 --- /dev/null +++ b/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/default_ibm_security_verify_saas.conf @@ -0,0 +1,870 @@ +# Product: IBM +# Category: SaaS Application +# Supported Format: JSON +# Reference : N/A +# Last Updated: 2023-10-27 +# Copyright 2023 Chronicle LLC + +filter { + mutate { + replace => { + "id" => "" + "data.origin" => "" + "geoip.ip" => "" + "geoip.city_name" => "" + "geoip.continent_name" => "" + "geoip.region_name" => "" + "geoip.country_name" => "" + "geoip.location.lon" => "" + "geoip.location.lat" => "" + "geoip.as_org" => "" + "geoip.country_iso_code" => "" + "data.sessionid" => "" + "data.userid" => "" + "data.devicetype" => "" + "data.username" => "" + "data.applicationname" => "" + "security_result" => "" + "action1" => "" + "data.result" => "" + "data.id_token" => "" + "data.redirecturl" => "" + "data.subtype" => "" + "data.grant_type" => "" + "data.grant_id" => "" + "tenantname" => "" + "data.applicationid" => "" + "data.client_id" => "" + "data.client_name" => "" + "data.client_type" => "" + "data.account_name" => "" + "data.applicationtype" => "" + "data.uasessionid" => "" + "data.scope" => "" + "data.at_hash" => "" + "data.rt_hash" => "" + "data.realm" => "" + "data.target" => "" + "tenantid" => "" + "correlationid" => "" + "time" => "" + "servicename" => "" + "data.targetid" => "" + "meta_event_type" => "" + "event_type" => "" + "auth_type" => "AUTHTYPE_UNSPECIFIED" + "data.ib_request_id" => "" + "data.status_code" => "" + "data.performedby_type" => "" + "data.subject_type" => "" + "data.target_type" => "" + "data.cause" => "" + "data.templateid" => "" + "data.subjectid" => "" + "data.performedby" => "" + "data.action" => "" + "data.performedby_clientname" => "" + "data.json.Operations" => "" + } + } + + json { + source => "message" + array_function => "split_columns" + on_error => "not_json" + } + json { + source => "data.json" + array_function => "split_columns" + on_error => "data_not_json" + target => "data.json" + } + if [time] != "" { + mutate { + convert => { + "time" => "string" + } + on_error => "already_string" + } + date { + match => ["time", "UNIX"] + on_error => "date_not_matched" + } + if [date_not_matched] { + date { + match => ["time", "UNIX_MS"] + on_error => "date_not_matched1" + } + } + } + if [tenantid] != "" { + mutate { + replace => { + "event.idm.read_only_udm.metadata.product_deployment_id" => "%{tenantid}" + } + on_error => "no_tenantid" + } + } + if [data][target] != "" { + mutate { + replace => { + "event.idm.read_only_udm.target.user.userid" => "%{data.target}" + } + on_error => "data_target_not_empty" + } + } + if [data][ib_request_id] != "" { + mutate { + replace => { + "event.idm.read_only_udm.metadata.product_log_id" => "%{data.ib_request_id}" + } + on_error => "data_target_id_not_empty" + } + } + if [data][targetid] != "" { + mutate { + replace => { + "event.idm.read_only_udm.target.resource.id" => "%{data.targetid}" + } + on_error => "data_target_id_not_empty" + } + } + if [data][account_name] != "" { + mutate { + replace => { + "event.idm.read_only_udm.target.user.user_display_name" => "%{data.account_name}" + } + on_error => "data_account_name_not_empty" + } + } + if [servicename] != "" { + mutate { + replace => { + "event.idm.read_only_udm.target.application" => "%{servicename}" + } + on_error => "service_name_not_empty" + } + } + if [data][origin] != "" { + mutate { + merge => { + "event.idm.read_only_udm.principal.ip" => "data.origin" + } + on_error => "data_origin_not_empty" + } + } + else if [geoip][ip] != "" { + mutate { + merge => { + "event.idm.read_only_udm.principal.ip" => "geoip.geoip" + } + on_error => "geoip_ip_not_empty" + } + } + if [data][username] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.user.user_display_name" => "%{data.username}" + } + on_error => "data_username_not_empty" + } + } + if [data][userid] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.user.userid" => "%{data.userid}" + } + on_error => "data_userid_not_empty" + } + } + if [data][realm] != "" { + mutate { + replace => { + "additional_realm.key" => "realm" + "additional_realm.value.string_value" => "%{data.realm}" + } + on_error => "data_realm_not_empty" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_realm" + } + } + } + if [data][subtype] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.resource.resource_subtype" => "%{data.subtype}" + } + on_error => "data_subtype_not_empty" + } + } + if [data][applicationname] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.application" => "%{data.applicationname}" + } + on_error => "data_app_name_not_empty" + } + } + if [data][redirecturl] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.url" => "%{data.redirecturl}" + } + on_error => "data_url_not_empty" + } + } + if [data][applicationid] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.resource.product_object_id" => "%{data.applicationid}" + } + on_error => "data_app_id_not_empty" + } + } + if [data][devicetype] != "" { + mutate { + replace => { + "event.idm.read_only_udm.network.http.user_agent" => "%{data.devicetype}" + } + on_error => "data_device_type_not_empty" + } + + mutate { + convert => { + "data.devicetype" => "parseduseragent" + } + } + mutate { + rename => { + "data.devicetype" => "event.idm.read_only_udm.network.http.parsed_user_agent" + } + } + } + if [tenantname] != "" { + mutate { + replace => { + "event.idm.read_only_udm.observer.hostname" => "%{tenantname}" + } + on_error => "tenantname_not_empty" + } + } + if [geoip][location][lat] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.location.region_latitude" => "%{geoip.location.lat}" + } + convert => { + "event.idm.read_only_udm.principal.location.region_latitude" => "float" + } + on_error => "location_lat_not_empty" + } + } + + if [geoip][location][lon] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.location.region_longitude" => "%{geoip.location.lon}" + } + convert => { + "event.idm.read_only_udm.principal.location.region_longitude" => "float" + } + on_error => "location_lon_not_empty" + } + } + + if [geoip][city_name] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.location.city" => "%{geoip.city_name}" + } + on_error => "city_name_not_empty" + } + } + + if [geoip][country_name] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.location.country_or_region" => "%{geoip.country_name}" + } + on_error => "country_name_not_empty" + } + } + + if [geoip][region_name] != "" { + mutate { + replace => { + "event.idm.read_only_udm.principal.location.state" => "%{geoip.region_name}" + } + on_error => "region_name_not_empty" + } + } + if [data][sessionid] != "" { + mutate { + replace => { + "event.idm.read_only_udm.network.session_id" => "%{data.sessionid}" + } + on_error => "sess_not_empty" + } + } + if [geoip][continent_name] != "" { + mutate { + replace => { + "additional_continent_name.key" => "continent_name" + "additional_continent_name.value.string_value" => "%{geoip.continent_name}" + } + on_error => "err1" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_continent_name" + } + on_error => "err1" + } + } + if [data][applicationtype] != "" { + mutate { + replace => { + "additional_applicationtype.key" => "applicationtype" + "additional_applicationtype.value.string_value" => "%{data.applicationtype}" + } + on_error => "err2" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_applicationtype" + } + on_error => "err2" + } + } + if [data][id_token] != "" { + mutate { + replace => { + "additional_id_token.key" => "id_token" + "additional_id_token.value.string_value" => "%{data.id_token}" + } + on_error => "err3" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_id_token" + } + on_error => "err3" + } + } + if [data][grant_id] != "" { + mutate { + replace => { + "additional_grant_id.key" => "grant_id" + "additional_grant_id.value.string_value" => "%{data.grant_id}" + } + on_error => "err4" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_grant_id" + } + on_error => "err4" + } + } + if [data][grant_type] != "" { + mutate { + replace => { + "additional_grant_type.key" => "grant_type" + "additional_grant_type.value.string_value" => "%{data.grant_type}" + } + on_error => "err5" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_grant_type" + } + on_error => "err5" + } + } + if [data][at_hash] != "" { + mutate { + replace => { + "additional_at_hash.key" => "at_hash" + "additional_at_hash.value.string_value" => "%{data.at_hash}" + } + on_error => "err6" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_at_hash" + } + on_error => "err6" + } + } + if [data][rt_hash] != "" { + mutate { + replace => { + "additional_rt_hash.key" => "rt_hash" + "additional_rt_hash.value.string_value" => "%{data.rt_hash}" + } + on_error => "err7" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_rt_hash" + } + on_error => "err8" + } + } + if [id] != "" { + mutate { + replace => { + "additional_id.key" => "id" + "additional_id.value.string_value" => "%{id}" + } + on_error => "err9" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_id" + } + on_error => "err9" + } + } + if [data][status_code] != "" { + mutate { + replace => { + "additional_status_code.value" => "%{data.status_code}" + "additional_status_code.key" => "status_code" + } + on_error => "status_code_field_not_found" + } + mutate { + merge => { + "security_result.detection_fields" => "additional_status_code" + } + on_error => "field_not_found" + } + } + if [data][performedby_type] != "" { + mutate { + replace => { + "additional_performedby_type.value.string_value" => "%{data.performedby_type}" + "additional_performedby_type.key" => "performedby_type" + } + on_error => "performedby_type_field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_performedby_type" + } + on_error => "field_not_found" + } + } + if [data][subject_type] != "" { + mutate { + replace => { + "additional_subject_type.value.string_value" => "%{data.subject_type}" + "additional_subject_type.key" => "subject_type" + } + on_error => "subject_type_field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_subject_type" + } + on_error => "field_not_found" + } + } + if [data][target_type] != "" { + mutate { + replace => { + "additional_target_type.value.string_value" => "%{data.target_type}" + "additional_target_type.key" => "target_type" + } + on_error => "target_type_field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_target_type" + } + on_error => "field_not_found" + } + } + if [data][templateid] != "" { + mutate { + replace => { + "additional_templateid.value.string_value" => "%{data.templateid}" + "additional_templateid.key" => "templateid" + } + on_error => "templateid_field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_templateid" + } + on_error => "field_not_found" + } + } + if [data][subjectid] != "" { + mutate { + replace => { + "additional_subjectid.value.string_value" => "%{data.subjectid}" + "additional_subjectid.key" => "subjectid" + } + on_error => "subjectid_field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_subjectid" + } + on_error => "field_not_found" + } + } + if [data][performedby] != "" { + mutate { + replace => { + "additional_performedby.value.string_value" => "%{data.performedby}" + "additional_performedby.key" => "performedby" + } + on_error => "performedby_field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_performedby" + } + on_error => "field_not_found" + } + } + if [data][action] != "" { + mutate { + replace => { + "additional_action.value.string_value" => "%{data.action}" + "additional_action.key" => "action" + } + on_error => "action_field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_action" + } + on_error => "field_not_found" + } + } + if [data][performedby_clientname] != "" { + mutate { + replace => { + "additional_performedby_clientname.value.string_value" => "%{data.performedby_clientname}" + "additional_performedby_clientname.key" => "performedby_clientname" + } + on_error => "performedby_clientname_field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_performedby_clientname" + } + on_error => "field_not_found" + } + } + if [data][scope] != "" { + mutate { + replace => { + "additional_scope.key" => "scope" + "additional_scope.value.string_value" => "%{data.scope}" + } + on_error => "scope_not_empty" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_scope" + } + on_error => "scope_not_empty" + } + } + if [data][uasessionid] != "" { + mutate { + replace => { + "additional_uasessionid.key" => "uasessionid" + "additional_uasessionid.value.string_value" => "%{data.uasessionid}" + } + on_error => "client_sess_id_not_empty" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_uasessionid" + } + on_error => "client_sess_id_not_empty" + } + } + if [data][client_id] != "" { + mutate { + replace => { + "additional_client_id.key" => "client_id" + "additional_client_id.value" => "%{data.client_id}" + } + on_error => "client_id_not_empty" + } + mutate { + merge => { + "security_result.about.resource.attribute.labels" => "additional_client_id" + } + on_error => "client_id_not_empty" + } + } + if [data][client_name] != "" { + mutate { + replace => { + "additional_client_name.key" => "client_name" + "additional_client_name.value" => "%{data.client_name}" + } + on_error => "client_name_not_empty" + } + mutate { + merge => { + "security_result.about.resource.attribute.labels" => "additional_client_name" + } + on_error => "client_name_not_empty" + } + } + if [data][client_type] != "" { + mutate { + replace => { + "additional_client_type.key" => "client_type" + "additional_client_type.value" => "%{data.client_type}" + } + on_error => "client_type_not_empty" + } + mutate { + merge => { + "security_result.about.resource.attribute.labels" => "additional_client_type" + } + on_error => "client_type_not_empty" + } + } + if [data][cause] != "" { + mutate { + replace => { + "security_result.summary" => "%{data.cause}" + } + on_error => "cause_field_not_found" + } + } + + for operation in data.json.Operations { + mutate { + replace => { + "additional_operation_label" => "" + "operation_path" => "" + "operation_value" => "" + } + } + mutate { + replace => { + "operation_path" => "%{operation.path}" + } + on_error => "field_not_found" + } + mutate { + replace => { + "operation_value" => "%{operation.value}" + } + on_error => "field_not_found" + } + if [operation_path] in ["name.givenName", "name.familyName", "name.middleName", "ipdScore"] or [operation][path] =~ "emails|phoneNumbers" { + if [operation_value] != "" { + mutate { + replace => { + "additional_operation_label.key" => "op: %{operation.op}, path: %{operation.path}" + "additional_operation_label.value.string_value" => "%{operation.value}" + } + on_error => "field_not_found" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_operation_label" + } + on_error => "field_not_found" + } + } + } + if [operation_path] == "urn:ietf:params:scim:schemas:extension:ibm:2.0:User:customAttributes" { + mutate { + replace => { + "operation_value_name" => "" + } + } + mutate { + replace => { + "operation_value_name" => "%{operation.value.name}" + } + on_error => "field_not_found" + } + if [operation_value_name] in ["eidmsecuremail", "eidmsecuremob"] { + mutate { + replace => { + "additional_operation_label.key" => "op: %{operation.op}, path: %{operation.value.name}" + } + on_error => "field_not_found" + } + for index, field in operation.value.values { + if [index] == 0 { + mutate { + replace => { + "field_value" => "%{field}" + } + } + } + else { + mutate { + replace => { + "field_value" => "%{field_value}, %{field}" + } + on_error => "field_not_found" + } + } + } + mutate { + replace => { + "additional_operation_label.value.string_value" => "%{field_value}" + } + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_operation_label" + } + on_error => "field_not_found" + } + } + } + } + + if [correlationid] != "" { + mutate { + replace => { + "additional_correlationid.key" => "correlationid" + "additional_correlationid.value" => "%{correlationid}" + } + on_error => "correlationid_not_empty" + } + mutate { + merge => { + "security_result.detection_fields" => "additional_correlationid" + } + on_error => "correlationid_not_empty" + } + } + if [event_type] != "" { + mutate { + replace => { + "event.idm.read_only_udm.metadata.product_event_type" => "%{event_type}" + } + } + if [event_type] in ["sso", "SSO"] { + mutate { + replace => { + "auth_type" => "SSO" + } + } + } + } + if [data][result] != "" { + if [data][result] == "success" { + mutate { + replace => { + "action1" => "ALLOW" + } + } + } + mutate { + replace => { + "security_result.action_details" => "%{data.result}" + } + on_error => "no_data_result" + } + } + if [action1] != "" { + mutate { + merge => { + "security_result.action" => "action1" + } + } + } + if [geoip][as_org] != "" { + mutate { + replace => { + "additional_as_org.key" => "as_org" + "additional_as_org.value.string_value" => "%{geoip.as_org}" + } + on_error => "as_org_not_empty" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_as_org" + } + on_error => "as_org_not_empty" + } + } + if [geoip][country_iso_code] != "" { + mutate { + replace => { + "additional_country_iso_code.key" => "country_iso_code" + "additional_country_iso_code.value.string_value" => "%{geoip.country_iso_code}" + } + on_error => "country_iso_code_not_empty" + } + mutate { + merge => { + "event.idm.read_only_udm.additional.fields" => "additional_country_iso_code" + } + on_error => "country_iso_code_not_empty" + } + } + if [data][target] != "" { + mutate { + replace => { + "meta_event_type" => "USER_LOGIN" + "event.idm.read_only_udm.extensions.auth.type" => "%{auth_type}" + } + on_error => "no_auth_type" + } + } + else if [data][userid] != "" { + mutate { + replace => { + "meta_event_type" => "USER_UNCATEGORIZED" + } + } + } + else if [data][origin] != "" or [geoip][ip] != "" { + mutate { + replace => { + "meta_event_type" => "STATUS_UPDATE" + } + } + } + else { + mutate { + replace => { + "meta_event_type" => "GENERIC_EVENT" + } + } + } + if [security_result] != "" { + mutate { + merge => { + "event.idm.read_only_udm.security_result" => "security_result" + } + on_error => "no_security_result" + } + } + mutate { + replace => { + "event.idm.read_only_udm.metadata.product_name" => "IBM_SECURITY_VERIFY_SAAS" + "event.idm.read_only_udm.metadata.vendor_name" => "IBM_SECURITY_VERIFY_SAAS" + "event.idm.read_only_udm.metadata.event_type" => "%{meta_event_type}" + } + on_error => "no_meta_event_type" + } + mutate { + merge => { + "@output" => "event" + } + } +} diff --git a/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/metadata.json b/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/metadata.json new file mode 100644 index 0000000000..d30a94369f --- /dev/null +++ b/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/metadata.json @@ -0,0 +1,8 @@ +{ + "log_type": "IBM_SECURITY_VERIFY_SAAS", + "product": "IBM_SECURITY_VERIFY_SAAS", + "vendor": "IBM_SECURITY_VERIFY_SAAS", + "supported_format": "JSON", + "category": "SaaS Application", + "run_internal_tests": false +} \ No newline at end of file diff --git a/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..9924458f50 --- /dev/null +++ b/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,462 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "action": "user_login_sso", + "applicationtype": "enterprise_web_app", + "as_org": "AS12345 Cloud Provider", + "at_hash": "at-hash-value-1001", + "continent_name": "North America", + "country_iso_code": "US", + "grant_id": "grant-uuid-1001", + "grant_type": "authorization_code", + "id": "log-entry-1001", + "id_token": "jwt-token-id-1001", + "op: add, path: emails[type eq \"work\"].value": "dummy_user_1001@dummy.com", + "op: add, path: phoneNumbers": "+1-555-0101", + "op: replace, path: eidmsecuremail": "secure_mail1@dummy.com, secure_mail2@dummy.com", + "op: replace, path: eidmsecuremob": "+1-555-0191, +1-555-0192", + "op: replace, path: ipdScore": "95", + "op: replace, path: name.familyName": "MaskedFamily", + "op: replace, path: name.givenName": "MaskedGiven", + "op: replace, path: name.middleName": "MaskedMiddle", + "performedby": "dummy_admin_1001", + "performedby_clientname": "Verify SaaS Web Client", + "performedby_type": "security_admin", + "realm": "cloudIdentityRealm", + "rt_hash": "rt-hash-value-1001", + "scope": "openid profile email scim", + "subject_type": "end_user_account", + "subjectid": "subj-guid-1001", + "target_type": "user_identity", + "templateid": "tmpl-guid-1001", + "uasessionid": "ua-sess-1001" + }, + "extensions": { + "auth": { + "type": "SSO" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_LOGIN", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productDeploymentId": "tenant-alpha-001", + "productEventType": "sso", + "productLogId": "ib-req-guid-1001", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "network": { + "http": { + "parsedUserAgent": { + "annotation": [ + { + "key": "Chrome", + "value": "Chrome/1.1.1.3" + }, + { + "key": "SafariType", + "value": "Safari/537.36" + }, + { + "key": "OS_NAME", + "value": "Windows NT" + }, + { + "key": "OS_VERSION", + "value": "10.0" + }, + { + "key": "misc", + "value": "x64" + } + ], + "browser": "Chrome", + "browserEngineVersion": "537.36", + "browserType": "BROWSER_TYPE_CHROME", + "browserVariantType": "BROWSER_VARIANT_TYPE_UNKNOWN", + "browserVersion": "1.1.1.3", + "device": "x64", + "family": "APPLEWEBKIT", + "os": "Windows NT 10.0", + "osType": "OS_TYPE_WINDOWS", + "osVariant": "Win64", + "osVariantType": "OS_VARIANT_TYPE_UNKNOWN", + "platform": "Windows", + "subFamily": "AppleWebKit" + }, + "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.3 Safari/537.36" + }, + "sessionId": "sess-uuid-1001" + }, + "observer": { + "hostname": "tenant-alpha.verify.ibm.com" + }, + "principal": { + "application": "IBM Security Verify SaaS Portal", + "asset": { + "ip": [ + "1.1.1.2" + ] + }, + "ip": [ + "1.1.1.2" + ], + "location": { + "city": "Austin", + "countryOrRegion": "United States", + "regionLatitude": 30.2672, + "regionLongitude": -97.7431, + "state": "Texas" + }, + "resource": { + "productObjectId": "app-guid-1001", + "resourceSubtype": "saml_sso" + }, + "url": "https://portal.dummy.com/oauth2/callback", + "user": { + "userDisplayName": "dummy_user_1001@dummy.com", + "userid": "dummy_user_1001" + } + }, + "securityResult": [ + { + "about": { + "resource": { + "attribute": { + "labels": [ + { + "key": "client_id", + "value": "client-guid-1001" + }, + { + "key": "client_name", + "value": "Verify Admin Client" + }, + { + "key": "client_type", + "value": "confidential_app" + } + ] + } + } + }, + "action": [ + "ALLOW" + ], + "actionDetails": "success", + "detectionFields": [ + { + "key": "status_code", + "value": "200" + }, + { + "key": "correlationid", + "value": "corr-uuid-1001" + } + ], + "summary": "Authentication completed successfully via SSO" + } + ], + "target": { + "application": "ibm-verify-saas-auth", + "resource": { + "id": "target-res-guid-1001" + }, + "user": { + "userDisplayName": "dummy_account_1001", + "userid": "target_user_1001" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": {} + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "USER_LOGIN", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "observer": { + "hostname": "tenant-error.verify.ibm.com" + }, + "target": { + "user": { + "userid": "target_user_err" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productEventType": "AUTHENTICATION_FAILED", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "observer": { + "hostname": "tenant-empty.verify.ibm.com" + }, + "principal": { + "user": { + "userid": "dummy_user_2001" + } + }, + "securityResult": [ + { + "actionDetails": "failure" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": { + "type": "SSO" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_LOGIN", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productEventType": "SSO", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "observer": { + "hostname": "tenant-sso-ms.verify.ibm.com" + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "actionDetails": "success" + } + ], + "target": { + "user": { + "userid": "target_user_3001" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productEventType": "SYSTEM_STATUS_EVENT", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "observer": { + "hostname": "tenant-status-origin.verify.ibm.com" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.5" + ] + }, + "ip": [ + "1.1.1.5" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productEventType": "HEALTH_CHECK_EVENT", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "observer": { + "hostname": "tenant-status-geoip.verify.ibm.com" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.6" + ] + }, + "ip": [ + "1.1.1.6" + ] + }, + "target": { + "resource": { + "id": "target-status-res-7001" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "id": "log-generic-8001" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productEventType": "SYSTEM_CONFIGURATION", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "observer": { + "hostname": "tenant-generic.verify.ibm.com" + }, + "target": { + "application": "config-audit-service" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "id": "log-no-sec-9001" + }, + "extensions": { + "auth": {} + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_LOGIN", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productEventType": "USER_NOTIFICATION", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "observer": { + "hostname": "tenant-no-sec.verify.ibm.com" + }, + "principal": { + "user": { + "userid": "dummy_user_9001" + } + }, + "target": { + "user": { + "userid": "target_user_9001" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": {} + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_LOGIN", + "logType": "IBM_SECURITY_VERIFY_SAAS", + "productName": "IBM_SECURITY_VERIFY_SAAS", + "vendorName": "IBM_SECURITY_VERIFY_SAAS" + }, + "network": { + "http": { + "parsedUserAgent": { + "annotation": [ + { + "key": "Chrome", + "value": "Chrome/1.1.1.3" + }, + { + "key": "SafariType", + "value": "Safari/537.36" + }, + { + "key": "OS_NAME", + "value": "Linux x86_64" + } + ], + "browser": "Chrome", + "browserEngineVersion": "537.36", + "browserType": "BROWSER_TYPE_CHROME", + "browserVariantType": "BROWSER_VARIANT_TYPE_UNKNOWN", + "browserVersion": "1.1.1.3", + "family": "APPLEWEBKIT", + "os": "Linux x86_64", + "osType": "OS_TYPE_LINUX", + "osVariantType": "OS_VARIANT_TYPE_UNKNOWN", + "platform": "X11", + "subFamily": "AppleWebKit" + }, + "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.3 Safari/537.36" + } + }, + "observer": { + "hostname": "tenant-missing-keys.verify.ibm.com" + }, + "target": { + "user": { + "userid": "target_user_10001" + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..3b638b8643 --- /dev/null +++ b/content/parsers/third_party/community/IBM_SECURITY_VERIFY_SAAS_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,35 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"id\": \"log-entry-1001\", \"time\": 1728727200, \"tenantid\": \"tenant-alpha-001\", \"tenantname\": \"tenant-alpha.verify.ibm.com\", \"servicename\": \"ibm-verify-saas-auth\", \"correlationid\": \"corr-uuid-1001\", \"event_type\": \"sso\", \"geoip\": {\"ip\": \"1.1.1.1\", \"city_name\": \"Austin\", \"continent_name\": \"North America\", \"region_name\": \"Texas\", \"country_name\": \"United States\", \"location\": {\"lat\": \"30.2672\", \"lon\": \"-97.7431\"}, \"as_org\": \"AS12345 Cloud Provider\", \"country_iso_code\": \"US\"}, \"data\": {\"origin\": \"1.1.1.2\", \"sessionid\": \"sess-uuid-1001\", \"userid\": \"dummy_user_1001\", \"username\": \"dummy_user_1001@dummy.com\", \"devicetype\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.3 Safari/537.36\", \"applicationname\": \"IBM Security Verify SaaS Portal\", \"applicationid\": \"app-guid-1001\", \"applicationtype\": \"enterprise_web_app\", \"result\": \"success\", \"id_token\": \"jwt-token-id-1001\", \"redirecturl\": \"https://portal.dummy.com/oauth2/callback\", \"subtype\": \"saml_sso\", \"grant_type\": \"authorization_code\", \"grant_id\": \"grant-uuid-1001\", \"client_id\": \"client-guid-1001\", \"client_name\": \"Verify Admin Client\", \"client_type\": \"confidential_app\", \"account_name\": \"dummy_account_1001\", \"uasessionid\": \"ua-sess-1001\", \"scope\": \"openid profile email scim\", \"at_hash\": \"at-hash-value-1001\", \"rt_hash\": \"rt-hash-value-1001\", \"realm\": \"cloudIdentityRealm\", \"target\": \"target_user_1001\", \"targetid\": \"target-res-guid-1001\", \"ib_request_id\": \"ib-req-guid-1001\", \"status_code\": \"200\", \"performedby_type\": \"security_admin\", \"subject_type\": \"end_user_account\", \"target_type\": \"user_identity\", \"cause\": \"Authentication completed successfully via SSO\", \"templateid\": \"tmpl-guid-1001\", \"subjectid\": \"subj-guid-1001\", \"performedby\": \"dummy_admin_1001\", \"action\": \"user_login_sso\", \"performedby_clientname\": \"Verify SaaS Web Client\", \"json\": \"{\\\"Operations\\\":[{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"name.givenName\\\",\\\"value\\\":\\\"MaskedGiven\\\"},{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"name.familyName\\\",\\\"value\\\":\\\"MaskedFamily\\\"},{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"name.middleName\\\",\\\"value\\\":\\\"MaskedMiddle\\\"},{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"ipdScore\\\",\\\"value\\\":\\\"95\\\"},{\\\"op\\\":\\\"add\\\",\\\"path\\\":\\\"emails[type eq \\\\\\\"work\\\\\\\"].value\\\",\\\"value\\\":\\\"dummy_user_1001@dummy.com\\\"},{\\\"op\\\":\\\"add\\\",\\\"path\\\":\\\"phoneNumbers\\\",\\\"value\\\":\\\"+1-555-0101\\\"},{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"urn:ietf:params:scim:schemas:extension:ibm:2.0:User:customAttributes\\\",\\\"value\\\":{\\\"name\\\":\\\"eidmsecuremail\\\",\\\"values\\\":[\\\"secure_mail1@dummy.com\\\",\\\"secure_mail2@dummy.com\\\"]}},{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"urn:ietf:params:scim:schemas:extension:ibm:2.0:User:customAttributes\\\",\\\"value\\\":{\\\"name\\\":\\\"eidmsecuremob\\\",\\\"values\\\":[\\\"+1-555-0191\\\",\\\"+1-555-0192\\\"]}}]}\"}}" + }, + { + "data": "{\"tenantname\": \"tenant-error.verify.ibm.com\", \"time\": \"invalid_date_timestamp\", \"data\": {\"target\": \"target_user_err\", \"json\": \"{malformed_json_operations_syntax\"}, \"geoip\": {\"location\": {\"lat\": 37.7749, \"lon\": -122.4194}}}" + }, + { + "data": "{\"id\": \"\", \"time\": \"\", \"tenantid\": \"\", \"tenantname\": \"tenant-empty.verify.ibm.com\", \"servicename\": \"\", \"correlationid\": \"\", \"event_type\": \"AUTHENTICATION_FAILED\", \"geoip\": {\"ip\": \"1.1.1.4\", \"city_name\": \"\", \"continent_name\": \"\", \"region_name\": \"\", \"country_name\": \"\", \"location\": {\"lat\": \"\", \"lon\": \"\"}, \"as_org\": \"\", \"country_iso_code\": \"\"}, \"data\": {\"origin\": \"\", \"sessionid\": \"\", \"userid\": \"dummy_user_2001\", \"username\": \"\", \"devicetype\": \"\", \"applicationname\": \"\", \"applicationid\": \"\", \"applicationtype\": \"\", \"result\": \"failure\", \"id_token\": \"\", \"redirecturl\": \"\", \"subtype\": \"\", \"grant_type\": \"\", \"grant_id\": \"\", \"client_id\": \"\", \"client_name\": \"\", \"client_type\": \"\", \"account_name\": \"\", \"uasessionid\": \"\", \"scope\": \"\", \"at_hash\": \"\", \"rt_hash\": \"\", \"realm\": \"\", \"target\": \"\", \"targetid\": \"\", \"ib_request_id\": \"\", \"status_code\": \"\", \"performedby_type\": \"\", \"subject_type\": \"\", \"target_type\": \"\", \"cause\": \"\", \"templateid\": \"\", \"subjectid\": \"\", \"performedby\": \"\", \"action\": \"\", \"performedby_clientname\": \"\", \"json\": \"{\\\"Operations\\\":[{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"name.givenName\\\",\\\"value\\\":\\\"\\\"},{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"unmatched.attribute.path\\\",\\\"value\\\":\\\"test\\\"},{\\\"op\\\":\\\"replace\\\",\\\"path\\\":\\\"urn:ietf:params:scim:schemas:extension:ibm:2.0:User:customAttributes\\\",\\\"value\\\":{\\\"name\\\":\\\"other_custom_attr\\\",\\\"values\\\":[\\\"custom_val\\\"]}}]}\"}}" + }, + { + "data": "{\"tenantname\": \"tenant-sso-ms.verify.ibm.com\", \"time\": 1728727200000, \"event_type\": \"SSO\", \"data\": {\"target\": \"target_user_3001\", \"result\": \"success\"}}" + }, + { + "data": "{\"tenantname\": \"tenant-status-origin.verify.ibm.com\", \"event_type\": \"SYSTEM_STATUS_EVENT\", \"data\": {\"origin\": \"1.1.1.5\"}}" + }, + { + "data": "{\"tenantname\": \"tenant-status-geoip.verify.ibm.com\", \"event_type\": \"HEALTH_CHECK_EVENT\", \"geoip\": {\"ip\": \"1.1.1.6\"}, \"data\": {\"origin\": \"1.1.1.6\", \"targetid\": \"target-status-res-7001\"}}" + }, + { + "data": "{\"id\": \"log-generic-8001\", \"tenantname\": \"tenant-generic.verify.ibm.com\", \"servicename\": \"config-audit-service\", \"event_type\": \"SYSTEM_CONFIGURATION\"}" + }, + { + "data": "{\"id\": \"log-no-sec-9001\", \"tenantname\": \"tenant-no-sec.verify.ibm.com\", \"time\": 1728727200, \"event_type\": \"USER_NOTIFICATION\", \"data\": {\"target\": \"target_user_9001\", \"userid\": \"dummy_user_9001\"}}" + }, + { + "data": "{\"tenantname\": \"tenant-missing-keys.verify.ibm.com\", \"time\": 1728727200, \"data\": {\"target\": \"target_user_10001\", \"devicetype\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.3 Safari/537.36\"}}" + } + ], + "type": "IBM_SECURITY_VERIFY_SAAS" + } +} \ No newline at end of file