diff --git a/content/parsers/third_party/community/ONFIDO/cbn/default_onfido.conf b/content/parsers/third_party/community/ONFIDO/cbn/default_onfido.conf index 2820f30e1e..cd8e77e649 100644 --- a/content/parsers/third_party/community/ONFIDO/cbn/default_onfido.conf +++ b/content/parsers/third_party/community/ONFIDO/cbn/default_onfido.conf @@ -2,7 +2,7 @@ # Category: Authentication # Supported Format: SYSLOG + JSON, JSON # Reference: N/A -# Last Updated: 2026-07-24 +# Last Updated: 2026-08-26 # Copyright 2026 Google SecOps filter { @@ -20,10 +20,14 @@ filter { "grok_error" => "" "payload_action" => "" "completed_at_iso8601" => "" + "created_at_iso8601" => "" "payload_object_id" => "" "payload_resource_type" => "" "payload_href" => "" "payload_status" => "" + "user_agent" => "" + "activity" => "" + "workflow_run_uuid" => "" "has_user" => "" "has_principal" => "" "sr_action" => "" @@ -34,15 +38,72 @@ filter { match => { "message" => "%{TIMESTAMP_ISO8601:ts} %{WORD:timezone},%{DATA:user_name},%{DATA:user_email},(%{IP:src_ip}|\\\"\\\"),%{DATA:category},%{DATA:prod_evt_type},(\\\"%{GREEDYDATA:json_data}\\\"|\\\"|)" } - overwrite => ["ts", "timezone", "check_id", "prod_evt_type", "user_name", "user_email", "src_ip", "json_data", "category"] + overwrite => ["ts", "timezone", "prod_evt_type", "user_name", "user_email", "src_ip", "json_data", "category"] on_error => "grok_error" } if [grok_error] { + mutate { + gsub => ["message", '\\"workflow_run_uuid\\": <([a-zA-Z0-9_]+)>', '\"workflow_run_uuid\": \"<$1>\"'] + } json { source => "message" array_function => "split_columns" on_error => "json_error" } + mutate { + replace => { + "user_name" => "%{payload.object.user.full_name}" + } + on_error => "user_name_json_error" + } + mutate { + replace => { + "user_email" => "%{payload.object.user.email}" + } + on_error => "user_email_json_error" + } + mutate { + replace => { + "src_ip" => "%{payload.object.user.ip_address}" + } + on_error => "src_ip_json_error" + } + mutate { + replace => { + "user_agent" => "%{payload.object.user.user_agent}" + } + on_error => "user_agent_json_error" + } + mutate { + replace => { + "category" => "%{payload.object.category}" + } + on_error => "category_json_error" + } + mutate { + replace => { + "activity" => "%{payload.object.activity}" + } + on_error => "activity_json_error" + } + mutate { + replace => { + "check_id" => "%{payload.object.details.check_id}" + } + on_error => "check_id_json_error" + } + mutate { + replace => { + "workflow_run_uuid" => "%{payload.object.details.workflow_run_uuid}" + } + on_error => "workflow_run_uuid_json_error" + } + mutate { + replace => { + "created_at_iso8601" => "%{payload.object.created_at_iso8601}" + } + on_error => "created_at_iso8601_json_error" + } } if [timezone] != "" { # Compute Timezone Offset if it's loaded by KVData @@ -1143,19 +1204,49 @@ filter { } if [src_ip] != "" { - mutate { - merge => { - "event.idm.read_only_udm.principal.ip" => "src_ip" - "event.idm.read_only_udm.principal.asset.ip" => "src_ip" + grok { + match => { + "src_ip" => "%{IP:src_ip}" } - on_error => "src_ip_error" + overwrite => ["src_ip"] + on_error => "src_ip_not_ip" } - if ![src_ip_error] { + if ![src_ip_not_ip] { mutate { - replace => { - "has_principal" => "true" + merge => { + "event.idm.read_only_udm.principal.ip" => "src_ip" + "event.idm.read_only_udm.principal.asset.ip" => "src_ip" } + on_error => "src_ip_error" + } + if ![src_ip_error] { + mutate { + replace => { + "has_principal" => "true" + } + } + } + } + } + + if [user_agent] != "" { + mutate { + replace => { + "event.idm.read_only_udm.network.http.user_agent" => "%{user_agent}" } + on_error => "user_agent_error" + } + mutate { + replace => { + "event.idm.read_only_udm.network.http.parsed_user_agent" => "%{user_agent}" + } + on_error => "user_agent_invalid" + } + mutate { + convert => { + "event.idm.read_only_udm.network.http.parsed_user_agent" => "parseduseragent" + } + on_error => "user_agent_convert_error" } } @@ -1168,6 +1259,15 @@ filter { } } + if [workflow_run_uuid] != "" { + mutate { + replace => { + "event.idm.read_only_udm.metadata.product_log_id" => "%{workflow_run_uuid}" + } + on_error => "workflow_run_uuid_error" + } + } + if [category] != "" { mutate { merge => { @@ -1177,6 +1277,15 @@ filter { } } + if [activity] != "" { + mutate { + replace => { + "sr.summary" => "%{activity}" + } + on_error => "activity_error" + } + } + mutate { replace => { "payload_action" => "%{payload.action}" @@ -1191,6 +1300,7 @@ filter { on_error => "product_event_type_error" } } + mutate { replace => { "completed_at_iso8601" => "%{payload.object.completed_at_iso8601}" @@ -1204,6 +1314,15 @@ filter { on_error => "completed_at_iso8601_error" } } + + if [created_at_iso8601] != "" { + date { + match => ["created_at_iso8601", "ISO8601"] + target => "event.idm.read_only_udm.metadata.event_timestamp" + on_error => "created_at_iso8601_date_error" + } + } + mutate { replace => { "payload_object_id" => "%{payload.object.id}" @@ -1218,6 +1337,7 @@ filter { on_error => "payload_object_id_error" } } + mutate { replace => { "payload_resource_type" => "%{payload.resource_type}" @@ -1232,6 +1352,7 @@ filter { on_error => "resource_type_error" } } + mutate { replace => { "payload_href" => "%{payload.object.href}" @@ -1246,6 +1367,7 @@ filter { on_error => "url_error" } } + mutate { replace => { "payload_status" => "%{payload.object.status}" @@ -1269,7 +1391,8 @@ filter { } } } - if [prod_evt_type] == "Successful login" and [has_user] == "true" { + + if ([prod_evt_type] in ["Successful login", "successful_login"] or [activity] == "successful_login") and [has_user] == "true" { mutate { replace => { "event.idm.read_only_udm.metadata.event_type" => "USER_LOGIN" diff --git a/content/parsers/third_party/community/ONFIDO/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/ONFIDO/cbn/testdata/expected_events/default_events.json index 8b1243588c..77f53c41f2 100644 --- a/content/parsers/third_party/community/ONFIDO/cbn/testdata/expected_events/default_events.json +++ b/content/parsers/third_party/community/ONFIDO/cbn/testdata/expected_events/default_events.json @@ -152,6 +152,263 @@ } } } + }, + { + "event": { + "timestamp": "2026-08-20T07:50:29Z", + "idm": { + "readOnlyUdm": { + "additional": { + "object_status": "complete" + }, + "metadata": { + "eventTimestamp": "2026-08-20T07:50:29Z", + "eventType": "GENERIC_EVENT", + "logType": "ONFIDO", + "productEventType": "check.completed", + "productName": "ONFIDO", + "vendorName": "ONFIDO" + }, + "target": { + "resource": { + "productObjectId": "1aa1111a-a111-1aa1-a111-1a1aa11a1111", + "resourceSubtype": "check" + }, + "url": "https://api.maskeddomain1.com/v3.6/checks/1aa1111a-a111-1aa1-a111-1a1aa11a1111" + } + } + } + } + }, + { + "event": { + "timestamp": "2022-12-19T16:41:44Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2022-12-19T16:41:44Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "ONFIDO", + "productEventType": "audit_log.created", + "productLogId": "\u003cWORKFLOW_RUN_UUID\u003e", + "productName": "ONFIDO", + "vendorName": "ONFIDO" + }, + "network": { + "http": { + "parsedUserAgent": { + "device": "Mozilla", + "deviceVersion": "5.0", + "family": "USER_DEFINED" + }, + "userAgent": "Mozilla/5.0" + } + }, + "principal": { + "asset": { + "ip": [ + "127.0.0.1" + ] + }, + "ip": [ + "127.0.0.1" + ] + }, + "securityResult": [ + { + "categoryDetails": [ + "workflow_results" + ], + "summary": "view_workflow_run" + } + ], + "target": { + "resource": { + "resourceSubtype": "audit_log" + }, + "user": { + "emailAddresses": [ + "masked@abc.com" + ], + "userDisplayName": "Dummyname1 Dummylastname1" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2026-05-19T09:56:34Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2026-05-19T09:56:34Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "ONFIDO", + "productEventType": "audit_log.created", + "productLogId": "33cc3333-333c-333c-c3c3-c333c33333cc", + "productName": "ONFIDO", + "vendorName": "ONFIDO" + }, + "network": { + "http": { + "parsedUserAgent": { + "annotation": [ + { + "key": "Chrome", + "value": "Chrome/148.0.0.0" + }, + { + "key": "SafariType", + "value": "Safari/537.36" + }, + { + "key": "OS_NAME", + "value": "Intel Mac OS X" + }, + { + "key": "OS_VERSION", + "value": "10_15_7" + } + ], + "browser": "Chrome", + "browserEngineVersion": "537.36", + "browserType": "BROWSER_TYPE_CHROME", + "browserVariantType": "BROWSER_VARIANT_TYPE_UNKNOWN", + "browserVersion": "148.0.0.0", + "family": "APPLEWEBKIT", + "os": "Intel Mac OS X 10_15_7", + "osType": "OS_TYPE_MAC_OS", + "osVariantType": "OS_VARIANT_TYPE_UNKNOWN", + "platform": "Macintosh", + "subFamily": "AppleWebKit" + }, + "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" + } + }, + "principal": { + "asset": { + "ip": [ + "5.1.1.1" + ] + }, + "ip": [ + "5.1.1.1" + ] + }, + "securityResult": [ + { + "categoryDetails": [ + "checks" + ], + "summary": "view_record" + } + ], + "target": { + "resource": { + "productObjectId": "22b2b2bb-b2b2-222b-22bb-2bb22bb2b2b2", + "resourceSubtype": "audit_log" + }, + "user": { + "emailAddresses": [ + "dummy@dummy" + ], + "userDisplayName": "dummy name2" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2026-08-10T14:55:31Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": {} + }, + "metadata": { + "eventTimestamp": "2026-08-10T14:55:31Z", + "eventType": "USER_LOGIN", + "logType": "ONFIDO", + "productEventType": "audit_log.created", + "productName": "ONFIDO", + "vendorName": "ONFIDO" + }, + "network": { + "http": { + "parsedUserAgent": { + "annotation": [ + { + "key": "Chrome", + "value": "Chrome/148.0.0.0" + }, + { + "key": "SafariType", + "value": "Safari/537.36" + }, + { + "key": "OS_NAME", + "value": "Intel Mac OS X" + }, + { + "key": "OS_VERSION", + "value": "10_15_7" + } + ], + "browser": "Chrome", + "browserEngineVersion": "537.36", + "browserType": "BROWSER_TYPE_CHROME", + "browserVariantType": "BROWSER_VARIANT_TYPE_UNKNOWN", + "browserVersion": "148.0.0.0", + "family": "APPLEWEBKIT", + "os": "Intel Mac OS X 10_15_7", + "osType": "OS_TYPE_MAC_OS", + "osVariantType": "OS_VARIANT_TYPE_UNKNOWN", + "platform": "Macintosh", + "subFamily": "AppleWebKit" + }, + "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" + } + }, + "principal": { + "asset": { + "ip": [ + "5.1.1.1" + ] + }, + "ip": [ + "5.1.1.1" + ] + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "categoryDetails": [ + "user_activity" + ], + "summary": "successful_login" + } + ], + "target": { + "resource": { + "productObjectId": "44d4c44d-44dd-444d-d444-444444444444", + "resourceSubtype": "audit_log" + }, + "user": { + "emailAddresses": [ + "dummy@dummy" + ], + "userDisplayName": "dummy name2" + } + } + } + } + } } ] } \ No newline at end of file diff --git a/content/parsers/third_party/community/ONFIDO/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/ONFIDO/cbn/testdata/raw_logs/default_log.json index b198e86c3a..6ab82a2424 100644 --- a/content/parsers/third_party/community/ONFIDO/cbn/testdata/raw_logs/default_log.json +++ b/content/parsers/third_party/community/ONFIDO/cbn/testdata/raw_logs/default_log.json @@ -17,6 +17,22 @@ { "collection_time": "2026-07-22T05:48:31.094814854Z", "data": "{\"payload\":{\"resource_type\":\"report\",\"action\":\"report.completed\",\"object\":{\"id\":\"12345678-1111-1111-1111-123456789012\",\"status\":\"complete\",\"completed_at_iso8601\":\"2026-07-20T07:41:15Z\",\"href\":\"https://abc.abc.com/v3.6/reports/12345678-1111-1111-1111-123456789012\"}}}" + }, + { + "collection_time": "2026-08-25T10:14:01.350407524Z", + "data": "{\r\n \"payload\": {\r\n \"resource_type\": \"check\",\r\n \"action\": \"check.completed\",\r\n \"object\": {\r\n \"id\": \"1aa1111a-a111-1aa1-a111-1a1aa11a1111\",\r\n \"status\": \"complete\",\r\n \"completed_at_iso8601\": \"2026-08-20T07:50:29Z\",\r\n \"href\": \"https://api.maskeddomain1.com/v3.6/checks/1aa1111a-a111-1aa1-a111-1a1aa11a1111\"\r\n }\r\n }\r\n}" + }, + { + "collection_time": "2026-08-25T10:14:30.824269931Z", + "data": "{\r\n \"payload\": {\r\n \"resource_type\": \"audit_log\",\r\n \"action\": \"audit_log.created\",\r\n \"object\": {\r\n \"activity\": \"view_workflow_run\",\r\n \"category\": \"workflow_results\",\r\n \"created_at_iso8601\": \"2022-12-19T16:41:44Z\",\r\n \"details\": {\r\n \"workflow_run_uuid\": \u003cWORKFLOW_RUN_UUID\u003e\r\n },\r\n \"user\": {\r\n \"email\": \"masked@abc.com\",\r\n \"full_name\": \"Dummyname1 Dummylastname1\",\r\n \"ip_address\": \"127.0.0.1\",\r\n \"user_agent\": \"Mozilla/5.0\"\r\n }\r\n }\r\n }\r\n}" + }, + { + "collection_time": "2026-08-25T10:14:58.435718987Z", + "data": "{\r\n \"payload\": {\r\n \"resource_type\": \"audit_log\",\r\n \"action\": \"audit_log.created\",\r\n \"object\": {\r\n \"id\": \"22b2b2bb-b2b2-222b-22bb-2bb22bb2b2b2\",\r\n \"activity\": \"view_record\",\r\n \"category\": \"checks\",\r\n \"details\": {\r\n \"check_id\": \"33cc3333-333c-333c-c3c3-c333c33333cc\"\r\n },\r\n \"created_at_iso8601\": \"2026-05-19T09:56:34Z\",\r\n \"user\": {\r\n \"email\": \"dummy@dummy\",\r\n \"full_name\": \"dummy name2\",\r\n \"ip_address\": \"5.1.1.1\",\r\n \"user_agent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36\"\r\n }\r\n }\r\n }\r\n}" + }, + { + "collection_time": "2026-08-25T10:15:26.867036044Z", + "data": "{\r\n \"payload\": {\r\n \"resource_type\": \"audit_log\",\r\n \"action\": \"audit_log.created\",\r\n \"object\": {\r\n \"id\": \"44d4c44d-44dd-444d-d444-444444444444\",\r\n \"activity\": \"successful_login\",\r\n \"category\": \"user_activity\",\r\n \"details\": null,\r\n \"created_at_iso8601\": \"2026-08-10T14:55:31Z\",\r\n \"user\": {\r\n \"email\": \"dummy@dummy\",\r\n \"full_name\": \"dummy name2\",\r\n \"ip_address\": \"5.1.1.1\",\r\n \"user_agent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36\"\r\n }\r\n }\r\n }\r\n}" } ], "type": "ONFIDO"