[b/549538131] - Enhancement for ONFIDO parser to support JSON formatted logs

content/parsers/third_party/community/ONFIDO/cbn/default_onfido.conf

@@ -2,7 +2,7 @@
 # Category: Authentication
 # Supported Format: SYSLOG + JSON, JSON
 # Reference: N/A
-# Last Updated: 2026-07-24
+# Last Updated: 2026-08-26
 # Copyright 2026 Google SecOps
 
 filter {
@@ -20,10 +20,14 @@ filter {
       "grok_error" => ""
       "payload_action" => ""
       "completed_at_iso8601" => ""
+      "created_at_iso8601" => ""
       "payload_object_id" => ""
       "payload_resource_type" => ""
       "payload_href" => ""
       "payload_status" => ""
+      "user_agent" => ""
+      "activity" => ""
+      "workflow_run_uuid" => ""
       "has_user" => ""
       "has_principal" => ""
       "sr_action" => ""
@@ -34,15 +38,72 @@ filter {
     match => {
       "message" => "%{TIMESTAMP_ISO8601:ts} %{WORD:timezone},%{DATA:user_name},%{DATA:user_email},(%{IP:src_ip}|\\\"\\\"),%{DATA:category},%{DATA:prod_evt_type},(\\\"%{GREEDYDATA:json_data}\\\"|\\\"|)"
     }
-    overwrite => ["ts", "timezone", "check_id", "prod_evt_type", "user_name", "user_email", "src_ip", "json_data", "category"]
+    overwrite => ["ts", "timezone", "prod_evt_type", "user_name", "user_email", "src_ip", "json_data", "category"]
     on_error => "grok_error"
   }
   if [grok_error] {
+    mutate {
+      gsub => ["message", '\\"workflow_run_uuid\\": <([a-zA-Z0-9_]+)>', '\"workflow_run_uuid\": \"<$1>\"']
+    }
     json {
       source => "message"
       array_function => "split_columns"
       on_error => "json_error"
     }
+    mutate {
+      replace => {
+        "user_name" => "%{payload.object.user.full_name}"
+      }
+      on_error => "user_name_json_error"
+    }
+    mutate {
+      replace => {
+        "user_email" => "%{payload.object.user.email}"
+      }
+      on_error => "user_email_json_error"
+    }
+    mutate {
+      replace => {
+        "src_ip" => "%{payload.object.user.ip_address}"
+      }
+      on_error => "src_ip_json_error"
+    }
+    mutate {
+      replace => {
+        "user_agent" => "%{payload.object.user.user_agent}"
+      }
+      on_error => "user_agent_json_error"
+    }
+    mutate {
+      replace => {
+        "category" => "%{payload.object.category}"
+      }
+      on_error => "category_json_error"
+    }
+    mutate {
+      replace => {
+        "activity" => "%{payload.object.activity}"
+      }
+      on_error => "activity_json_error"
+    }
+    mutate {
+      replace => {
+        "check_id" => "%{payload.object.details.check_id}"
+      }
+      on_error => "check_id_json_error"
+    }
+    mutate {
+      replace => {
+        "workflow_run_uuid" => "%{payload.object.details.workflow_run_uuid}"
+      }
+      on_error => "workflow_run_uuid_json_error"
+    }
+    mutate {
+      replace => {
+        "created_at_iso8601" => "%{payload.object.created_at_iso8601}"
+      }
+      on_error => "created_at_iso8601_json_error"
+    }
   }
   if [timezone] != "" {
     # Compute Timezone Offset if it's loaded by KVData
@@ -1143,19 +1204,49 @@ filter {
   }
 
   if [src_ip] != "" {
-    mutate {
-      merge => {
-        "event.idm.read_only_udm.principal.ip" => "src_ip"
-        "event.idm.read_only_udm.principal.asset.ip" => "src_ip"
+    grok {
+      match => {
+        "src_ip" => "%{IP:src_ip}"
       }
-      on_error => "src_ip_error"
+      overwrite => ["src_ip"]
+      on_error => "src_ip_not_ip"
     }
-    if ![src_ip_error] {
+    if ![src_ip_not_ip] {
       mutate {
-        replace => {
-          "has_principal" => "true"
+        merge => {
+          "event.idm.read_only_udm.principal.ip" => "src_ip"
+          "event.idm.read_only_udm.principal.asset.ip" => "src_ip"
         }
+        on_error => "src_ip_error"
+      }
+      if ![src_ip_error] {
+        mutate {
+          replace => {
+            "has_principal" => "true"
+          }
+        }
+      }
+    }
+  }
+
+  if [user_agent] != "" {
+    mutate {
+      replace => {
+        "event.idm.read_only_udm.network.http.user_agent" => "%{user_agent}"
       }
+      on_error => "user_agent_error"
+    }
+    mutate {
+      replace => {
+        "event.idm.read_only_udm.network.http.parsed_user_agent" => "%{user_agent}"
+      }
+      on_error => "user_agent_invalid"
+    }
+    mutate {
+      convert => {
+        "event.idm.read_only_udm.network.http.parsed_user_agent" => "parseduseragent"
+      }
+      on_error => "user_agent_convert_error"
     }
   }
 
@@ -1168,6 +1259,15 @@ filter {
     }
   }
 
+  if [workflow_run_uuid] != "" {
+    mutate {
+      replace => {
+        "event.idm.read_only_udm.metadata.product_log_id" => "%{workflow_run_uuid}"
+      }
+      on_error => "workflow_run_uuid_error"
+    }
+  }
+
   if [category] != "" {
     mutate {
       merge => {
@@ -1177,6 +1277,15 @@ filter {
     }
   }
 
+  if [activity] != "" {
+    mutate {
+      replace => {
+        "sr.summary" => "%{activity}"
+      }
+      on_error => "activity_error"
+    }
+  }
+
   mutate {
     replace => {
       "payload_action" => "%{payload.action}"
@@ -1191,6 +1300,7 @@ filter {
       on_error => "product_event_type_error"
     }
   }
+
   mutate {
     replace => {
       "completed_at_iso8601" => "%{payload.object.completed_at_iso8601}"
@@ -1204,6 +1314,15 @@ filter {
       on_error => "completed_at_iso8601_error"
     }
   }
+
+  if [created_at_iso8601] != "" {
+    date {
+      match => ["created_at_iso8601", "ISO8601"]
+      target => "event.idm.read_only_udm.metadata.event_timestamp"
+      on_error => "created_at_iso8601_date_error"
+    }
+  }
+
   mutate {
     replace => {
       "payload_object_id" => "%{payload.object.id}"
@@ -1218,6 +1337,7 @@ filter {
       on_error => "payload_object_id_error"
     }
   }
+
   mutate {
     replace => {
       "payload_resource_type" => "%{payload.resource_type}"
@@ -1232,6 +1352,7 @@ filter {
       on_error => "resource_type_error"
     }
   }
+
   mutate {
     replace => {
       "payload_href" => "%{payload.object.href}"
@@ -1246,6 +1367,7 @@ filter {
       on_error => "url_error"
     }
   }
+
   mutate {
     replace => {
       "payload_status" => "%{payload.object.status}"
@@ -1269,7 +1391,8 @@ filter {
       }
     }
   }
-  if [prod_evt_type] == "Successful login" and [has_user] == "true" {
+
+  if ([prod_evt_type] in ["Successful login", "successful_login"] or [activity] == "successful_login") and [has_user] == "true" {
     mutate {
       replace => {
         "event.idm.read_only_udm.metadata.event_type" => "USER_LOGIN"