Skip to content

Commit 2be7f18

Browse files
JulienOrainJulienOrain
authored
azure: fix Grok processor error for firewall network rule logs (#13920)
1 parent 964463f commit 2be7f18

File tree

5 files changed

+99
-1
lines changed

5 files changed

+99
-1
lines changed

‎packages/azure/changelog.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
- version: "1.27.1"
2+
changes:
3+
- description: Add missing pattern for DNAT request messages for `AzureFirewallNetworkRuleLog` in firewall_logs data stream.
4+
type: bugfix
5+
link: https://github.com/elastic/integrations/pull/13920
16
- version: "1.27.0"
27
changes:
38
- description: Standardize user fields processing across integrations.

‎packages/azure/data_stream/firewall_logs/_dev/test/pipeline/test-networkrules-raw.log

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@
88
{"category":"AzureFirewallNetworkRule","operationName":"AzureFirewallNetworkRuleLog","properties":{"msg":"HTTP request from 192.168.0.2:54314 to ocsp.sca1b.amazontrust.com:80. Url: ocsp.sca1b.amazontrust.com. Action: Deny. ThreatIntel: Bot Networks"},"resourceId":"/SUBSCRIPTIONS/23103928-B2CF-472A-8CDB-0146E2849129/RESOURCEGROUPS/TEST-FW-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/TEST-FW01","time":"2022-06-08T20:40:56.4525380Z"}
99
{"category":"AzureFirewallNetworkRule","operationName":"AzureFirewallNetworkRuleLog","properties":{"msg":"ICMP request from 192.168.0.2: to 175.16.199.1:. Action: alert. Signature: 2100366. IDS: ICMP_INFO PING *NIX. Priority: 3. Classification: Misc activity"},"resourceId":"/SUBSCRIPTIONS/23103928-B2CF-472A-8CDB-0146E2849129/RESOURCEGROUPS/TEST-FW-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/TEST-FW01","time":"2022-06-08T20:40:56.4525380Z"}
1010
{"category":"AzureFirewallNetworkRule","operationName":"AzureFirewallNetworkRuleLog","properties":{"msg":"TCP request from 192.168.0.2:50306 to 89.160.20.156:3389. Action: Allow.. Rule Collection: Permit_RFC1918. Rule: Permit_RFC1918"},"resourceId":"/SUBSCRIPTIONS/23103928-B2CF-472A-8CDB-0146E2849129/RESOURCEGROUPS/TEST-FW-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/TEST-FW01","time":"2025-03-13T07:11:59.992099+00:00"}
11+
{"category":"AzureFirewallNetworkRule","operationName":"AzureFirewallNatRuleLog","properties":{"msg":"TCP request from 192.168.0.2:50306 to 89.160.20.156:3388 was DNAT'ed to 10.0.0.2:3388. Rule Collection: DNAT. Rule: rule"},"resourceId":"/SUBSCRIPTIONS/23103928-B2CF-472A-8CDB-0146E2849129/RESOURCEGROUPS/TEST-FW-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/TEST-FW01","time":"2022-06-08T20:40:56.4525380Z"}

‎packages/azure/data_stream/firewall_logs/_dev/test/pipeline/test-networkrules-raw.log-expected.json

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -839,6 +839,97 @@
839839
"tags": [
840840
"preserve_original_event"
841841
]
842+
},
843+
{
844+
"@timestamp": "2022-06-08T20:40:56.452Z",
845+
"azure": {
846+
"firewall": {
847+
"category": "AzureFirewallNetworkRule",
848+
"operation_name": "AzureFirewallNatRuleLog"
849+
},
850+
"resource": {
851+
"group": "TEST-FW-RG",
852+
"id": "/SUBSCRIPTIONS/23103928-B2CF-472A-8CDB-0146E2849129/RESOURCEGROUPS/TEST-FW-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/TEST-FW01",
853+
"name": "TEST-FW01",
854+
"provider": "MICROSOFT.NETWORK/AZUREFIREWALLS"
855+
},
856+
"subscription_id": "23103928-B2CF-472A-8CDB-0146E2849129"
857+
},
858+
"cloud": {
859+
"account": {
860+
"id": "23103928-B2CF-472A-8CDB-0146E2849129"
861+
},
862+
"provider": "azure"
863+
},
864+
"destination": {
865+
"address": "89.160.20.156",
866+
"as": {
867+
"number": 29518,
868+
"organization": {
869+
"name": "Bredband2 AB"
870+
}
871+
},
872+
"geo": {
873+
"city_name": "Linköping",
874+
"continent_name": "Europe",
875+
"country_iso_code": "SE",
876+
"country_name": "Sweden",
877+
"location": {
878+
"lat": 58.4167,
879+
"lon": 15.6167
880+
},
881+
"region_iso_code": "SE-E",
882+
"region_name": "Östergötland County"
883+
},
884+
"ip": "89.160.20.156",
885+
"nat": {
886+
"ip": "10.0.0.2",
887+
"port": 3388
888+
},
889+
"port": 3388
890+
},
891+
"ecs": {
892+
"version": "8.11.0"
893+
},
894+
"event": {
895+
"category": [
896+
"network"
897+
],
898+
"kind": "event",
899+
"original": "{\"category\":\"AzureFirewallNetworkRule\",\"operationName\":\"AzureFirewallNatRuleLog\",\"properties\":{\"msg\":\"TCP request from 192.168.0.2:50306 to 89.160.20.156:3388 was DNAT'ed to 10.0.0.2:3388. Rule Collection: DNAT. Rule: rule\"},\"resourceId\":\"/SUBSCRIPTIONS/23103928-B2CF-472A-8CDB-0146E2849129/RESOURCEGROUPS/TEST-FW-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/TEST-FW01\",\"time\":\"2022-06-08T20:40:56.4525380Z\"}",
900+
"type": [
901+
"connection"
902+
]
903+
},
904+
"network": {
905+
"iana_number": "6",
906+
"transport": "tcp"
907+
},
908+
"observer": {
909+
"name": "TEST-FW01",
910+
"product": "Network Firewall",
911+
"type": "firewall",
912+
"vendor": "Azure"
913+
},
914+
"related": {
915+
"ip": [
916+
"192.168.0.2",
917+
"89.160.20.156",
918+
"10.0.0.2"
919+
]
920+
},
921+
"rule": {
922+
"name": "rule",
923+
"ruleset": "DNAT"
924+
},
925+
"source": {
926+
"address": "192.168.0.2",
927+
"ip": "192.168.0.2",
928+
"port": 50306
929+
},
930+
"tags": [
931+
"preserve_original_event"
932+
]
842933
}
843934
]
844935
}

‎packages/azure/data_stream/firewall_logs/elasticsearch/ingest_pipeline/default.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ processors:
190190
- "^%{DATA:azure.firewall.proto} Type=%{DATA:azure.firewall.icmp.request.code} request from %{IPORHOST:source.address} to %{IPORHOST:destination.address}. Action: %{DATA:azure.firewall.action}. $"
191191
- "^%{DATA:azure.firewall.proto} request from %{IPORHOST:source.address}:%{NUMBER:source.port:long} to %{IPORHOST:destination.address}:%{NUMBER:destination.port:long} was DNAT'ed to %{IP:destination.nat.ip}:%{NUMBER:destination.nat.port:long}$"
192192
- "^%{DATA:azure.firewall.proto} request from %{IPORHOST:source.address}:%{NUMBER:source.port:long} to %{IPORHOST:destination.address}:%{NUMBER:destination.port:long} was DNAT'ed to %{IP:destination.nat.ip}:%{NUMBER:destination.nat.port:long}. Policy: %{DATA:azure.firewall.policy}. Rule Collection Group: %{DATA:azure.firewall.rule_collection_group}. Rule Collection: %{DATA:rule.ruleset}. Rule: %{DATA:rule.name}$"
193+
- "^%{DATA:azure.firewall.proto} request from %{IPORHOST:source.address}:%{NUMBER:source.port:long} to %{IPORHOST:destination.address}:%{NUMBER:destination.port:long} was DNAT'ed to %{IP:destination.nat.ip}:%{NUMBER:destination.nat.port:long}. Rule Collection: %{DATA:rule.ruleset}. Rule: %{DATA:rule.name}$"
193194
- "^%{DATA:azure.firewall.proto} request from %{IPORHOST:source.address}:(%{NUMBER:source.port:long})? to %{IPORHOST:destination.address}:(%{NUMBER:destination.port:long})?. Action: %{DATA:azure.firewall.action}. Signature: %{DATA:rule.id}. IDS: %{DATA:rule.name}. Priority: %{NUMBER:event.risk_score:long}. Classification: %{DATA:rule.category}$"
194195
- "^%{DATA:azure.firewall.proto} request from %{IPORHOST:source.address}:%{NUMBER:source.port:long} to %{IPORHOST:destination.address}:%{NUMBER:destination.port:long}. Url: %{HOSTNAME:url.original}. Action: %{DATA:azure.firewall.action}. ThreatIntel: %{DATA:rule.name}$"
195196
if: ctx?.json?.operationName == 'AzureFirewallNetworkRuleLog' || ctx?.json?.operationName == 'AzureFirewallNatRuleLog'

‎packages/azure/manifest.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: azure
22
title: Azure Logs
3-
version: "1.27.0"
3+
version: "1.27.1"
44
description: This Elastic integration collects logs from Azure
55
type: integration
66
icons:

0 commit comments

Comments
 (0)