[Check Point Harmony Endpoint] New Integration #10780

gauravneelwarna · 2024-08-13T14:19:50Z

Proposed commit message

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

[ ]

How to test this PR locally

Related issues

Closes [New Integration] Check Point Harmony Endpoint #10168

Screenshots

cla-checker-service · 2024-08-13T14:19:55Z

💚 CLA has been signed

chrisberkhout

A lot of great work in this. I'm impressed!

Hopefully a lot of the comments will be quick to address. Some will take a bit more time but then I think we'll be done or very close.

chrisberkhout · 2024-09-20T08:01:57Z

packages/checkpoint_harmony_endpoint/img/sample-logo.svg

This file can be removed.

Still needs to be removed.

No, it's still there.

It is removed from the manifest, but the file is still there in the img/ directory.

packages/checkpoint_harmony_endpoint/img/sample-screenshot.png

packages/checkpoint_harmony_endpoint/manifest.yml

packages/checkpoint_harmony_endpoint/changelog.yml

...point_harmony_endpoint/data_stream/threatemulation/elasticsearch/ingest_pipeline/default.yml

chrisberkhout · 2024-09-20T16:14:50Z

packages/checkpoint_harmony_endpoint/data_stream/antibot/agent/stream/antibot.yml.hbs

+{{#if enable_request_tracer}}
+resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson"
+resource.tracer.maxbackups: 5
+{{/if}}


The enable_request_tracer variable needs to be defined. Do it in the top level manifest.yml and make it default to false and not be shown to the user by default (so it will appear under "Advanced options").

Please add it once to the top-level integration manifest, then it can be removed from each of the data stream manifests.

The definition of enable_request_tracer in the top level manifest still needs to have a default: false setting added.

...point/kibana/dashboard/checkpoint_harmony_endpoint-21fdef7e-31b1-4eda-8842-3a100dc33851.json

chrisberkhout · 2024-09-20T16:30:33Z

❌ Author of the following commits did not sign a Contributor Agreement: f943064, 2081cfd, c7d0b6a, 1b1fddd, 85f04eb, 2740521, 346f9a0, 2ef5cea, a84d705, de5f43a, b2565e3, b4c0ec1, 3db6cc6

Please, read and sign the above mentioned agreement if you want to contribute to this project

Please do this so we're able to merge when ready.

…egrations into test-harmony

efd6 · 2024-10-17T06:55:32Z

@gauravneelwarna This PR cannot be reviewed until the CLA has been signed. From the list of commits shown by the CLA bot, there is a user called aniket-phapale. If this is you, please ensure that you have signed the CLA for that user as well. If it is not, please remove those commit from the change.

gauravneelwarna · 2024-10-17T08:34:48Z

@gauravneelwarna This PR cannot be reviewed until the CLA has been signed. From the list of commits shown by the CLA bot, there is a user called aniket-phapale. If this is you, please ensure that you have signed the CLA for that user as well. If it is not, please remove those commit from the change.

@efd6 aniket-phapale and other 2 users signed CLA. Please confirm and let me know if you need copies of the individual agreements.

chrisberkhout · 2024-10-17T08:53:04Z

@gauravneelwarna Did they sign via https://www.elastic.co/contributor-agreement?

We want to get this check to pass:

gauravneelwarna · 2024-10-17T08:54:54Z

@gauravneelwarna Did they sign via https://www.elastic.co/contributor-agreement?

We want to get this check to pass:

yes

chrisberkhout · 2024-10-17T08:57:04Z

/test

gauravneelwarna · 2024-10-17T10:35:45Z

/test

packages/checkpoint_harmony_endpoint/manifest.yml

chrisberkhout · 2024-10-23T16:25:14Z

packages/checkpoint_harmony_endpoint/data_stream/antibot/manifest.yml

+        required: true
+        show_user: false
+        default:
+          - forwarded


The diff above suggested to remove preserve_original_event and add forwarded, but preserve_original_event is still there. Please remove that also.

chrisberkhout · 2024-10-23T16:31:22Z

packages/checkpoint_harmony_endpoint/data_stream/antibot/agent/stream/antibot.yml.hbs

+{{#if enable_request_tracer}}
+resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson"
+resource.tracer.maxbackups: 5
+{{/if}}


The definition of enable_request_tracer in the top level manifest still needs to have a default: false setting added.

chrisberkhout · 2024-10-23T17:12:33Z

/test

packages/checkpoint_harmony_endpoint/manifest.yml

chrisberkhout · 2024-10-25T07:32:16Z

/test

chrisberkhout · 2024-10-25T08:39:47Z

/test

elastic-vault-github-plugin-prod · 2024-10-25T09:05:16Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elastic-sonarqube · 2024-10-25T09:05:38Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
91.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elasticmachine · 2024-10-25T09:05:39Z

💚 Build Succeeded

Buildkite Build
Commit: 9c50ea5

History

💔 Build #17565 failed f5ea746
💔 Build #17509 failed c8efd04
💔 Build #17283 failed 89eb017

cc @gauravneelwarna

chrisberkhout

All review points addressed. Thanks! It looks good.

elastic-vault-github-plugin-prod · 2024-10-25T10:42:57Z

Package checkpoint_harmony_endpoint - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=checkpoint_harmony_endpoint

A new integration for Check Point Harmony Endpoint. It uses the Check Point's Infinity Events API to get events related to Harmony Endpoint. The CEL program for each data stream is the same but each uses a different filter to select particular types of events. --------- Co-authored-by: aniket-phapale <aniket@GS-7038.GSLAB.COM> Co-authored-by: gitanjali-panhale <gitanjali.panhale@gslab.com>

in progress

f943064

andrewkroh added the New Integration Issue or pull request for creating a new integration package. label Aug 13, 2024

Updated CEL program and fields.yml

2081cfd

andrewkroh added the needs CLA User must sign the Elastic Contributor License before review. label Aug 19, 2024

andrewkroh changed the title ~~in progress~~ [Check Point Harmony Endpoint] New Integration - WIP Aug 19, 2024

gauravneelwarna added 5 commits August 26, 2024 17:36

Updated cel script and manifest files

c7d0b6a

Fixed comma in status.cursor

1b1fddd

renamed base_url to url

85f04eb

Fixed CEL script to run in mito

2740521

Forensics data stream is created

346f9a0

chrisberkhout marked this pull request as draft September 4, 2024 08:42

chrisberkhout assigned gauravneelwarna Sep 4, 2024

chrisberkhout self-requested a review September 4, 2024 08:42

chrisberkhout added the Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] label Sep 4, 2024

gauravneelwarna added 6 commits September 4, 2024 14:51

Added prefix variable in CEL script

2ef5cea

Added ECS fields

a84d705

Initial system test config

de5f43a

Added pipeline test for forensics

b2565e3

Added data streams basic structure

b4c0ec1

Added data streams, System tests, pipeline tests, and kibana dashboard

3db6cc6

chrisberkhout mentioned this pull request Sep 20, 2024

[New Integration] Check Point Harmony Endpoint #10168

Closed

8 tasks

chrisberkhout requested changes Sep 20, 2024

View reviewed changes

aniket-phapale added 6 commits September 24, 2024 15:01

Seperated logs file and fixed Description in manifest files

7df13df

Updated fields mapping and manifest files

91c506f

Updated fields mapping

2ab99b8

Updated cel code and manifest files

787fc5c

Fixed typo in cel code

e46c724

Optimized the cel code as suggested in comnents

6e60002

gitanjali-panhale and others added 4 commits October 16, 2024 17:54

Fix: Formated CEL Code

d76620a

Merge branch 'test-harmony' of https://github.com/gauravneelwarna/int…

e9b5a7e

…egrations into test-harmony

Updated the description of Limit in manifest file

af98abd

fix: update sample_events.json files

89eb017

aniket-phapale added 2 commits October 17, 2024 14:46

Added dummy event in cel code

7c1a909

Updated codeowners file

c8efd04

chrisberkhout reviewed Oct 23, 2024

View reviewed changes

packages/checkpoint_harmony_endpoint/manifest.yml Outdated Show resolved Hide resolved

aniket-phapale added 2 commits October 24, 2024 11:09

comments fixed

2f557b5

Updated the kibana version

f5ea746

Updated README.md

9c50ea5

chrisberkhout approved these changes Oct 25, 2024

View reviewed changes

chrisberkhout merged commit 836ac57 into elastic:main Oct 25, 2024
5 checks passed

andrewkroh added Integration:checkpoint_harmony_endpoint Check Point Harmony Endpoint and removed needs CLA User must sign the Elastic Contributor License before review. labels Oct 28, 2024

[Check Point Harmony Endpoint] New Integration #10780

[Check Point Harmony Endpoint] New Integration #10780

Uh oh!

Conversation

gauravneelwarna commented Aug 13, 2024 • edited by chrisberkhout Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

cla-checker-service bot commented Aug 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chrisberkhout left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chrisberkhout commented Sep 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

efd6 commented Oct 17, 2024

Uh oh!

gauravneelwarna commented Oct 17, 2024

Uh oh!

chrisberkhout commented Oct 17, 2024

Uh oh!

gauravneelwarna commented Oct 17, 2024

Uh oh!

chrisberkhout commented Oct 17, 2024

Uh oh!

gauravneelwarna commented Oct 17, 2024

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chrisberkhout commented Oct 23, 2024

Uh oh!

Uh oh!

chrisberkhout commented Oct 25, 2024

Uh oh!

chrisberkhout commented Oct 25, 2024

Uh oh!

elastic-vault-github-plugin-prod bot commented Oct 25, 2024

🚀 Benchmarks report

Uh oh!

elastic-sonarqube bot commented Oct 25, 2024

Quality Gate passed

Uh oh!

gauravneelwarna commented Aug 13, 2024 •

edited by chrisberkhout

Loading

cla-checker-service bot commented Aug 13, 2024 •

edited

Loading

chrisberkhout commented Sep 20, 2024 •

edited

Loading