checkpoint: allow configuration of time zones (#5157)

Author: efd6

packages/checkpoint/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.12.0"
+  changes:
+    - description: Allow configuration of time zones.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/5157
 - version: "1.11.0"
   changes:
     - description: Update package to ECS 8.6.0.

packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json

@@ -25,6 +25,7 @@
                 "original": "\u003c134\u003e1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 7776 - [action:\"Accept\"; flags:\"444676\"; ifdir:\"outbound\"; ifname:\"eth0\"; logid:\"0\"; loguid:\"{0x5e819dc3,0x0,0x353707c7,0xee78a1dc}\"; origin:\"192.168.1.100\"; originsicname:\"cn=cp_mgmt,o=gw-da58d3..tmn8s8\"; sequencenum:\"1\"; time:\"1594646954\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 \u0026 FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1585502566;policy_name=Standard\\]\"; dst:\"192.168.1.153\"; inzone:\"Local\"; layer_name:\"Network\"; layer_uuid:\"63b7fe60-76d2-4287-bca5-21af87337b0a\"; match_id:\"1\"; parent_rule:\"0\"; rule_action:\"Accept\"; rule_uid:\"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2\"; outzone:\"External\"; product:\"VPN-1 \u0026 FireWall-1\"; proto:\"17\"; s_port:\"43103\"; service:\"514\"; service_id:\"syslog\"; src:\"192.168.1.100\"]",
                 "outcome": "success",
                 "sequence": 1,
+                "timezone": "UTC",
                 "type": [
                     "allowed",
                     "connection"
@@ -101,7 +102,8 @@
                 "id": "{0x60928f1d,0x8,0x40de101f,0xfcdbb197}",
                 "kind": "event",
                 "original": "\u003c134\u003e1 2021-05-05T12:27:09Z cp-m CheckPoint 1231 - [action:\"Drop\"; flags:\"278528\"; ifdir:\"inbound\"; ifname:\"bond1.3999\"; loguid:\"{0x60928f1d,0x8,0x40de101f,0xfcdbb197}\"; origin:\"127.0.0.1\"; originsicname:\"CN=CP,O=cp.com.9jjkfo\"; sequencenum:\"62\"; time:\"1620217629\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 \u0026 FireWall-1[db_tag={F6212FB3-54CE-6344-9164-B224119E2B92};mgmt=cp-m;date=1620031791;policy_name=CP-Cluster]\"; action_reason:\"Dropped by multiportal infrastructure\"; dst:\"81.2.69.144\"; product:\"VPN \u0026 FireWall\"; proto:\"6\"; s_port:\"52780\"; service:\"80\"; src:\"81.2.69.144\"]",
-                "sequence": 62
+                "sequence": 62,
+                "timezone": "UTC"
             },
             "network": {
                 "direction": "inbound",
@@ -181,6 +183,7 @@
                 "original": "\u003c134\u003e1 2022-12-02T16:39:12.000Z fwmgr CheckPoint 45470 - [action:\"Decrypt\"; flags:\"417028\"; ifdir:\"inbound\"; ifname:\"bond2.204\"; logid:\"0\"; loguid:\"{0xdca02360,0x9c491391,0xb5348f,0x1c07d10c}\"; origin:\"172.16.2.9\"; originsicname:\"CN=cp_mgmt,O=fwmgr.sdasdqdqd.com.ds2wd2\"; sequencenum:\"178\"; time:\"1669999152000\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 \\u0026 FireWall-1[db_tag={F6212FB3-54CE-6344-9164-B224119E2B92};mgmt=fwmgr;date=1669986326;policy_name=Standard\\\\]\"; community:\"RemoteAccess\"; dst:\"192.168.1.153\"; fw_subproduct:\"VPN-1\"; inzone:\"External\"; lastupdatetime:\"1669999152\"; layer_name:\"Network\"; layer_uuid:\"e2117254-df10-4a5d-8d42-cacc362e077b\"; match_id:\"5\"; parent_rule:\"0\"; rule_action:\"Accept\"; rule_name:\"SysAdmn\"; rule_uid:\"9294591a-bc96-4916-bb63-926c31f8c943\"; methods::\"ESP: AES-128 + SHA1\"; outzone:\"Internal\"; peer_gateway:\"172.28.11.213\"; product:\"VPN-1 \\u0026 FireWall-1\"; proto:\"17\"; s_port:\"49129\"; scheme::\"IKE\"; service:\"53\"; service_id:\"domain-udp_\"; session_uid:\"{6389E8E3-0000-0000-AC10-0209F7730000}\"; src:\"192.168.1.153\"; src_user_dn:\" \"; src_user_name:\"srcuser \"; user:\"srcuser \"; vpn_feature_name:\"VPN\"]",
                 "outcome": "success",
                 "sequence": 178,
+                "timezone": "UTC",
                 "type": [
                     "allowed",
                     "connection"
@@ -262,6 +265,7 @@
                 "original": "\u003c134\u003e1 2022-12-02T16:39:12.000Z fwmgr CheckPoint 45470 - [action:\"Decrypt\"; flags:\"417028\"; ifdir:\"inbound\"; ifname:\"bond2.204\"; logid:\"0\"; loguid:\"{0xdca02360,0x9c491391,0xb5348f,0x1c07d10c}\"; origin:\"172.16.2.9\"; originsicname:\"CN=cp_mgmt,O=fwmgr.sdasdqdqd.com.ds2wd2\"; sequencenum:\"178\"; time:\"2021-05-05T12:27:09Z\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 \\u0026 FireWall-1[db_tag={F6212FB3-54CE-6344-9164-B224119E2B92};mgmt=fwmgr;date=1669986326;policy_name=Standard\\\\]\"; community:\"RemoteAccess\"; dst:\"192.168.1.153\"; fw_subproduct:\"VPN-1\"; inzone:\"External\"; lastupdatetime:\"1669999152\"; layer_name:\"Network\"; layer_uuid:\"e2117254-df10-4a5d-8d42-cacc362e077b\"; match_id:\"5\"; parent_rule:\"0\"; rule_action:\"Accept\"; rule_name:\"SysAdmn\"; rule_uid:\"9294591a-bc96-4916-bb63-926c31f8c943\"; methods::\"ESP: AES-128 + SHA1\"; outzone:\"Internal\"; peer_gateway:\"172.28.11.213\"; product:\"VPN-1 \\u0026 FireWall-1\"; proto:\"17\"; s_port:\"49129\"; scheme::\"IKE\"; service:\"53\"; service_id:\"domain-udp_\"; session_uid:\"{6389E8E3-0000-0000-AC10-0209F7730000}\"; src:\"192.168.1.153\"; src_user_dn:\" \"; src_user_name:\"srcuser \"; user:\"srcuser \"; vpn_feature_name:\"VPN\"]",
                 "outcome": "success",
                 "sequence": 178,
+                "timezone": "UTC",
                 "type": [
                     "allowed",
                     "connection"

packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log

@@ -19,3 +19,4 @@
 <134>1 2020-03-30T07:19:22Z gw-da58d3 CheckPoint 8363 - [action:"Accept"; flags:"411908"; ifdir:"inbound"; ifname:"eth0"; logid:"0"; loguid:"{0x5e819d7a,0x0,0x353707c7,0xee78a1dc}"; origin:"192.168.1.100"; originsicname:"cn=cp_mgmt,o=gw-da58d3..tmn8s8"; sequencenum:"1"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1585502566;policy_name=Standard\]"; dst:"192.168.1.255"; inzone:"External"; layer_name:"Network"; layer_uuid:"63b7fe60-76d2-4287-bca5-21af87337b0a"; match_id:"1"; parent_rule:"0"; rule_action:"Accept"; rule_uid:"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2"; outzone:"Local"; product:"VPN-1 & FireWall-1"; proto:"17"; s_port:"50024"; service:"137"; service_id:"nbname"; src:"192.168.1.196"]
 <134>1 2020-03-30T07:20:33Z gw-da58d3 CheckPoint 8363 - [action:"Accept"; flags:"411908"; ifdir:"inbound"; ifname:"eth0"; logid:"0"; loguid:"{0x5e819dc1,0x0,0x353707c7,0xee78a1dc}"; origin:"192.168.1.100"; originsicname:"cn=cp_mgmt,o=gw-da58d3..tmn8s8"; sequencenum:"1"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1585502566;policy_name=Standard\]"; dst:"192.168.1.100"; inzone:"External"; layer_name:"Network"; layer_uuid:"63b7fe60-76d2-4287-bca5-21af87337b0a"; match_id:"1"; parent_rule:"0"; rule_action:"Accept"; rule_uid:"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2"; outzone:"Local"; product:"VPN-1 & FireWall-1"; proto:"6"; s_port:"60226"; service:"22"; service_id:"ssh"; src:"192.168.1.205"]
 <134>1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 8363 - [action:"Accept"; flags:"444676"; ifdir:"outbound"; ifname:"eth0"; logid:"0"; loguid:"{0x5e819dc3,0x0,0x353707c7,0xee78a1dc}"; origin:"192.168.1.100"; originsicname:"cn=cp_mgmt,o=gw-da58d3..tmn8s8"; sequencenum:"1"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1585502566;policy_name=Standard\]"; dst:"192.168.1.153"; inzone:"Local"; layer_name:"Network"; layer_uuid:"63b7fe60-76d2-4287-bca5-21af87337b0a"; match_id:"1"; parent_rule:"0"; rule_action:"Accept"; rule_uid:"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2"; outzone:"External"; product:"VPN-1 & FireWall-1"; proto:"17"; s_port:"43103"; service:"514"; service_id:"syslog"; src:"192.168.1.100"]
+<134>1 2020-03-30T07:20:35 gw-da58d3 CheckPoint 8363 - [action:"Accept"; flags:"444676"; ifdir:"outbound"; ifname:"eth0"; logid:"0"; loguid:"{0x5e819dc3,0x0,0x353707c7,0xee78a1dc}"; origin:"192.168.1.100"; originsicname:"cn=cp_mgmt,o=gw-da58d3..tmn8s8"; sequencenum:"1"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1585502566;policy_name=Standard\]"; dst:"192.168.1.153"; inzone:"Local"; layer_name:"Network"; layer_uuid:"63b7fe60-76d2-4287-bca5-21af87337b0a"; match_id:"1"; parent_rule:"0"; rule_action:"Accept"; rule_uid:"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2"; outzone:"External"; product:"VPN-1 & FireWall-1"; proto:"17"; s_port:"43103"; service:"514"; service_id:"syslog"; src:"192.168.1.100"]