From 18090cda5a768f5d0a878738da483d75833a4021 Mon Sep 17 00:00:00 2001 From: Arnaud RENARD Date: Wed, 8 Jul 2026 16:23:32 +0200 Subject: [PATCH 1/2] [stormshield] Fix pipeline descriptions and correct documentation claims Fix the copy-pasted descriptions of the default and count ingest pipelines, remove field definitions that never appear in events (the pipeline consumes tz into event.timezone, converts duration into event.duration, renames msg to message, and drops origdst/origdstport after converting them to destination fields), and correct the documentation: the agent syslog processor is configured for RFC5424, so the README no longer presents the Legacy format as supported, and the compatibility section now covers SNS 4.x and 5.x, which share the same WELF key-value audit log format. Also document how to collect SNS IPFIX flow records with the NetFlow integration, update vendor links to the SNS v5 documentation, and use arrows for menu paths per the documentation style guide. --- .../stormshield/_dev/build/docs/README.md | 26 ++++++++------- packages/stormshield/changelog.yml | 8 +++++ .../elasticsearch/ingest_pipeline/count.yml | 2 +- .../elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/log/fields/fields.yml | 17 +--------- packages/stormshield/docs/README.md | 33 +++++++++---------- .../docs/knowledge_base/service_info.md | 18 +++++----- packages/stormshield/manifest.yml | 3 +- 8 files changed, 52 insertions(+), 57 deletions(-) diff --git a/packages/stormshield/_dev/build/docs/README.md b/packages/stormshield/_dev/build/docs/README.md index 61b52da5fb6..b7d36d070ed 100644 --- a/packages/stormshield/_dev/build/docs/README.md +++ b/packages/stormshield/_dev/build/docs/README.md @@ -9,7 +9,7 @@ The StormShield SNS integration for Elastic enables you to collect and analyze s This integration is compatible with the following third-party vendor systems: - Stormshield Network Security (SNS) firewalls running the unified firmware base. -- SNS v4.x, which is the primarily documented and tested version for these log formats. +- SNS 4.x and SNS 5.x, which share the same WELF key-value audit log format. ### How it works @@ -17,7 +17,7 @@ This integration collects logs from Stormshield SNS firewalls by receiving syslo ## What data does this integration collect? -The StormShield SNS integration collects a variety of security and system events from SNS instances. Each data stream provides specific insights into network activity: +The StormShield SNS integration collects a variety of security and system events from SNS instances into a single `log` data stream. The collected log families provide specific insights into network activity: - Firewall logs: These provide detailed records of filter and NAT policy decisions, including source and destination IP addresses, ports, and protocols. - Audit and administrative logs: These capture events related to administrative logins, configuration changes through `serverd`, and system-level operations. - Alarm logs: These contain security-specific alerts generated by the SNS Intrusion Prevention System (IPS) and detection engines. @@ -68,36 +68,40 @@ To configure Stormshield Network Security (SNS) to forward logs to the Elastic A 1. Log in to the Stormshield Network Security web administration interface. 2. Navigate to the **CONFIGURATION** tab. -3. Go to **NOTIFICATIONS > LOGS - SYSLOG - IPFIX**. +3. Go to **NOTIFICATIONS → LOGS - SYSLOG - IPFIX**. 4. In the **Syslog** section, make sure the service is enabled by switching the status to **ON**. 5. Select a **Profile** slot to edit (e.g., Profile 1). 6. In the **Syslog server** field, select or create a host object corresponding to the Elastic Agent host. 7. Enter the **Port** number matching your Elastic Agent configuration (e.g., `514` for UDP or `601` for TCP). 8. Select the **Protocol** (**UDP** or **TCP**) that matches your integration input. -9. Choose the **Format**: **RFC5424** is recommended for modern logging, though **Legacy** (BSD) is also supported. +9. Set the **Format** to **RFC5424**. The integration expects RFC5424 messages; the **Legacy** and **Legacy long** formats are not supported at this time. 10. In the **Advanced properties** section, enable the specific log families you want to send. Make sure **Filter Policy**, **Administration**, **System**, and **Alarms** are active. 11. Click **Apply** to save the syslog configuration. #### Enabling traffic logs for specific rules -1. Navigate to **Configuration > Security policy > Filter - NAT**. +1. Navigate to **Configuration → Security policy → Filter - NAT**. 2. Identify the security rules for which you want to collect logs. 3. Double-click a rule to open its properties. 4. Go to the **Action** menu or the General tab. 5. Set the **Log level** to **Standard (connection log)**. 6. Click **OK** and then click **Apply** at the top of the interface to deploy the policy change. +#### Collecting flow records over IPFIX (optional) + +SNS firewalls can also export network flow records over the IPFIX protocol, configured in the same **NOTIFICATIONS → LOGS - SYSLOG - IPFIX** module (default port `4739`). Flow records are not handled by this integration: to collect them, use the [NetFlow Records](https://www.elastic.co/docs/reference/integrations/netflow) integration, which supports IPFIX. Both integrations can run on the same Elastic Agent to combine audit logs with flow analytics. + #### Vendor resources -- [Stormshield SNS Syslog Configuration](https://documentation.stormshield.eu/SNS/v4/en/Content/User_Configuration_Manual_SNS_v4/Logs-syslog/Syslog_tab.htm) -- [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm) +- [Stormshield SNS Syslog Configuration](https://documentation.stormshield.eu/SNS/v5/en/Content/User_Configuration_Manual_SNS_v5/Logs-syslog/Syslog_tab.htm) +- [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v5/en/Content/Description_of_Audit_logs/Configure_logs.htm) - [FireMon - Stormshield Device Configuration Guide](https://docs.firemon.com/feature/Content/ADMINISTRATION/DEVICE/Devices/StormShield/Stormshield_Network_Security.htm?TocPath=Administration|Device|Devices|Choose+a+Device+to+Onboard|_____51) ### Set up steps in Kibana To set up the integration in Kibana, follow these steps: -1. In Kibana, navigate to **Management > Integrations**. +1. In Kibana, navigate to **Management → Integrations**. 2. Search for and select **Stormshield SNS**. 3. Click **Add Stormshield SNS**. 4. Configure the inputs based on your Stormshield SNS configuration. @@ -159,11 +163,11 @@ Perform the following actions on your Stormshield device to generate logs: #### 2. Check data in Kibana To verify the data in Kibana: -1. Navigate to **Analytics > Discover**. +1. Navigate to **Analytics → Discover**. 2. Select the `logs-*` data view. 3. Enter the following KQL filter in the search bar: `data_stream.dataset : "stormshield.log"` 4. Verify logs appear and expand an entry to confirm the presence of fields like `event.dataset`, `source.ip`, and `message`. -5. Navigate to **Analytics > Dashboards** and search for "Stormshield SNS" to view pre-built visualizations. +5. Navigate to **Analytics → Dashboards** and search for "Stormshield SNS" to view pre-built visualizations. ## Troubleshooting @@ -218,5 +222,5 @@ The following is a sample event for the `log` data stream: ### Vendor documentation links You'll find additional details about Stormshield SNS logs in these official resources: -* [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm) +* [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v5/en/Content/Description_of_Audit_logs/Configure_logs.htm) * [Stormshield Official Website](https://www.stormshield.com) diff --git a/packages/stormshield/changelog.yml b/packages/stormshield/changelog.yml index 832fc1c78c3..7cc80809f3f 100644 --- a/packages/stormshield/changelog.yml +++ b/packages/stormshield/changelog.yml @@ -1,4 +1,12 @@ # newer versions go on top +- version: "1.5.3" + changes: + - description: Fix ingest pipeline descriptions and remove field definitions that never appear in events (`stormshield.tz`, `stormshield.duration`, `stormshield.msg`, `stormshield.origdst`, `stormshield.origdstport`). + type: bugfix + link: https://github.com/elastic/integrations/pull/20030 + - description: Correct the syslog format and SNS version compatibility statements in the documentation, and document IPFIX flow collection through the NetFlow integration. + type: bugfix + link: https://github.com/elastic/integrations/pull/20030 - version: "1.5.2" changes: - description: Remove top level note from docs diff --git a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml index d723103ae7f..90c5f22565d 100644 --- a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml +++ b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml @@ -1,5 +1,5 @@ --- -description: Pipeline for processing monitor logs from Stormshield appliances. +description: Pipeline for processing count logs from Stormshield appliances. processors: - script: tag: script_process_devices diff --git a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 21e0487bae3..b3dddc52f73 100644 --- a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,5 @@ --- -description: Pipeline for processing sample logs +description: Pipeline for processing Stormshield SNS logs processors: - set: tag: set_ecs_version_f5923549 diff --git a/packages/stormshield/data_stream/log/fields/fields.yml b/packages/stormshield/data_stream/log/fields/fields.yml index 0fc537c57e8..4b5577319ae 100644 --- a/packages/stormshield/data_stream/log/fields/fields.yml +++ b/packages/stormshield/data_stream/log/fields/fields.yml @@ -22,21 +22,9 @@ - name: dstifname type: keyword description: 'Name of the object representing the traffics destination interface. String of characters in UTF-8 format. Example: dmz1 Available from: SNS v1.0.0.' - - name: duration - type: keyword - description: 'Duration of the connection in seconds. Decimal format. Example: "173.15"' - name: fw type: keyword description: 'firewall''s ID This is the name entered by the administrator or, by default, its serial number. String of characters in UTF-8 format. Example: firewall_name or V50XXXXXXXXXXXX Available from: SNS v1.0.0.' - - name: msg - type: keyword - description: 'Text message explaining the alarm. String of characters in UTF-8 format. Example: Port probe' - - name: origdst - type: keyword - description: 'Original IP address of the destination host (before translation or the application of a virtual connection). Decimal format. Example: 192.168.0.1 Available from: SNS v1.0.0.' - - name: origdstport - type: keyword - description: 'Original port number of the destination TCP/UDP port (before translation or the application of a virtual connection). Example: "80" Available from: SNS v1.0.0.' - name: service type: keyword description: 'Service (product with a dedicated port) on which the vulnerability was detected. String of characters in UTF-8 format. Example: OpenSSH_5.4' @@ -51,10 +39,7 @@ description: 'Local time at the beginning of the logged event (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0.' - name: system type: keyword - description: Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, etc). Decimal format representing a percentage. + description: Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, and so on). Decimal format representing a percentage. - name: time type: keyword description: 'Local time at which the log was recorded in the log file (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0.' - - name: tz - type: keyword - description: 'Time difference between the Firewalls time and GMT. This depends on the time zone used. String in +HHMM or -HHMM format. Available from: SNS v1.0.0.' diff --git a/packages/stormshield/docs/README.md b/packages/stormshield/docs/README.md index b6c07850c5b..f56d3892238 100644 --- a/packages/stormshield/docs/README.md +++ b/packages/stormshield/docs/README.md @@ -9,7 +9,7 @@ The StormShield SNS integration for Elastic enables you to collect and analyze s This integration is compatible with the following third-party vendor systems: - Stormshield Network Security (SNS) firewalls running the unified firmware base. -- SNS v4.x, which is the primarily documented and tested version for these log formats. +- SNS 4.x and SNS 5.x, which share the same WELF key-value audit log format. ### How it works @@ -17,7 +17,7 @@ This integration collects logs from Stormshield SNS firewalls by receiving syslo ## What data does this integration collect? -The StormShield SNS integration collects a variety of security and system events from SNS instances. Each data stream provides specific insights into network activity: +The StormShield SNS integration collects a variety of security and system events from SNS instances into a single `log` data stream. The collected log families provide specific insights into network activity: - Firewall logs: These provide detailed records of filter and NAT policy decisions, including source and destination IP addresses, ports, and protocols. - Audit and administrative logs: These capture events related to administrative logins, configuration changes through `serverd`, and system-level operations. - Alarm logs: These contain security-specific alerts generated by the SNS Intrusion Prevention System (IPS) and detection engines. @@ -68,36 +68,40 @@ To configure Stormshield Network Security (SNS) to forward logs to the Elastic A 1. Log in to the Stormshield Network Security web administration interface. 2. Navigate to the **CONFIGURATION** tab. -3. Go to **NOTIFICATIONS > LOGS - SYSLOG - IPFIX**. +3. Go to **NOTIFICATIONS → LOGS - SYSLOG - IPFIX**. 4. In the **Syslog** section, make sure the service is enabled by switching the status to **ON**. 5. Select a **Profile** slot to edit (e.g., Profile 1). 6. In the **Syslog server** field, select or create a host object corresponding to the Elastic Agent host. 7. Enter the **Port** number matching your Elastic Agent configuration (e.g., `514` for UDP or `601` for TCP). 8. Select the **Protocol** (**UDP** or **TCP**) that matches your integration input. -9. Choose the **Format**: **RFC5424** is recommended for modern logging, though **Legacy** (BSD) is also supported. +9. Set the **Format** to **RFC5424**. The integration expects RFC5424 messages; the **Legacy** and **Legacy long** formats are not supported at this time. 10. In the **Advanced properties** section, enable the specific log families you want to send. Make sure **Filter Policy**, **Administration**, **System**, and **Alarms** are active. 11. Click **Apply** to save the syslog configuration. #### Enabling traffic logs for specific rules -1. Navigate to **Configuration > Security policy > Filter - NAT**. +1. Navigate to **Configuration → Security policy → Filter - NAT**. 2. Identify the security rules for which you want to collect logs. 3. Double-click a rule to open its properties. 4. Go to the **Action** menu or the General tab. 5. Set the **Log level** to **Standard (connection log)**. 6. Click **OK** and then click **Apply** at the top of the interface to deploy the policy change. +#### Collecting flow records over IPFIX (optional) + +SNS firewalls can also export network flow records over the IPFIX protocol, configured in the same **NOTIFICATIONS → LOGS - SYSLOG - IPFIX** module (default port `4739`). Flow records are not handled by this integration: to collect them, use the [NetFlow Records](https://www.elastic.co/docs/reference/integrations/netflow) integration, which supports IPFIX. Both integrations can run on the same Elastic Agent to combine audit logs with flow analytics. + #### Vendor resources -- [Stormshield SNS Syslog Configuration](https://documentation.stormshield.eu/SNS/v4/en/Content/User_Configuration_Manual_SNS_v4/Logs-syslog/Syslog_tab.htm) -- [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm) +- [Stormshield SNS Syslog Configuration](https://documentation.stormshield.eu/SNS/v5/en/Content/User_Configuration_Manual_SNS_v5/Logs-syslog/Syslog_tab.htm) +- [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v5/en/Content/Description_of_Audit_logs/Configure_logs.htm) - [FireMon - Stormshield Device Configuration Guide](https://docs.firemon.com/feature/Content/ADMINISTRATION/DEVICE/Devices/StormShield/Stormshield_Network_Security.htm?TocPath=Administration|Device|Devices|Choose+a+Device+to+Onboard|_____51) ### Set up steps in Kibana To set up the integration in Kibana, follow these steps: -1. In Kibana, navigate to **Management > Integrations**. +1. In Kibana, navigate to **Management → Integrations**. 2. Search for and select **Stormshield SNS**. 3. Click **Add Stormshield SNS**. 4. Configure the inputs based on your Stormshield SNS configuration. @@ -159,11 +163,11 @@ Perform the following actions on your Stormshield device to generate logs: #### 2. Check data in Kibana To verify the data in Kibana: -1. Navigate to **Analytics > Discover**. +1. Navigate to **Analytics → Discover**. 2. Select the `logs-*` data view. 3. Enter the following KQL filter in the search bar: `data_stream.dataset : "stormshield.log"` 4. Verify logs appear and expand an entry to confirm the presence of fields like `event.dataset`, `source.ip`, and `message`. -5. Navigate to **Analytics > Dashboards** and search for "Stormshield SNS" to view pre-built visualizations. +5. Navigate to **Analytics → Dashboards** and search for "Stormshield SNS" to view pre-built visualizations. ## Troubleshooting @@ -340,23 +344,18 @@ You'll find a list of all exported fields in the following table: | source.port | Port of the source. | long | | stormshield.dstif | Name of the destination interface. String of characters in UTF-8 format. Example: Ethernet 1 Available from: SNS v1.0.0. | keyword | | stormshield.dstifname | Name of the object representing the traffics destination interface. String of characters in UTF-8 format. Example: dmz1 Available from: SNS v1.0.0. | keyword | -| stormshield.duration | Duration of the connection in seconds. Decimal format. Example: "173.15" | keyword | | stormshield.fw | firewall's ID This is the name entered by the administrator or, by default, its serial number. String of characters in UTF-8 format. Example: firewall_name or V50XXXXXXXXXXXX Available from: SNS v1.0.0. | keyword | | stormshield.in_bytes | Count of bytes coming into the firewall | long | | stormshield.logtype | The specific type of log this is from. | keyword | | stormshield.metadata | Flattened metadata | flattened | -| stormshield.msg | Text message explaining the alarm. String of characters in UTF-8 format. Example: Port probe | keyword | -| stormshield.origdst | Original IP address of the destination host (before translation or the application of a virtual connection). Decimal format. Example: 192.168.0.1 Available from: SNS v1.0.0. | keyword | -| stormshield.origdstport | Original port number of the destination TCP/UDP port (before translation or the application of a virtual connection). Example: "80" Available from: SNS v1.0.0. | keyword | | stormshield.out_bytes | Count of bytes leaving the firewall | long | | stormshield.ports | The network ports found on the device | keyword | | stormshield.service | Service (product with a dedicated port) on which the vulnerability was detected. String of characters in UTF-8 format. Example: OpenSSH_5.4 | keyword | | stormshield.srcif | Internal name of the interface at the source of the traffic. String of characters in UTF-8 format. Example: Ethernet0 Available from: SNS v1.0.0. | keyword | | stormshield.srcifname | Name of the object representing the interface at the source of the traffic. String of characters in UTF-8 format. Example: out Available from: SNS v1.0.0. | keyword | | stormshield.startime | Local time at the beginning of the logged event (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0. | keyword | -| stormshield.system | Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, etc). Decimal format representing a percentage. | keyword | +| stormshield.system | Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, and so on). Decimal format representing a percentage. | keyword | | stormshield.time | Local time at which the log was recorded in the log file (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0. | keyword | -| stormshield.tz | Time difference between the Firewalls time and GMT. This depends on the time zone used. String in +HHMM or -HHMM format. Available from: SNS v1.0.0. | keyword | | tags | List of keywords used to tag each event. | keyword | | user.name | Short name or login of the user. | keyword | | user.name.text | Multi-field of `user.name`. | match_only_text | @@ -457,5 +456,5 @@ An example event for `log` looks as following: ### Vendor documentation links You'll find additional details about Stormshield SNS logs in these official resources: -* [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm) +* [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v5/en/Content/Description_of_Audit_logs/Configure_logs.htm) * [Stormshield Official Website](https://www.stormshield.com) diff --git a/packages/stormshield/docs/knowledge_base/service_info.md b/packages/stormshield/docs/knowledge_base/service_info.md index b86b2016170..0cc8737fe89 100644 --- a/packages/stormshield/docs/knowledge_base/service_info.md +++ b/packages/stormshield/docs/knowledge_base/service_info.md @@ -23,7 +23,7 @@ The **Stormshield SNS logs** integration collects a variety of security and syst This integration is compatible with the following third-party vendor systems: - **Stormshield Network Security (SNS)** firewalls running the unified firmware base. -- **SNS v4.x** is the primarily documented and tested version for these log formats. +- **SNS 4.x and SNS 5.x**, which share the same WELF key-value audit log format. ## Scaling and Performance @@ -57,19 +57,19 @@ To configure Stormshield Network Security (SNS) to forward logs to the Elastic A 1. Log in to the Stormshield Network Security web administration interface. 2. Navigate to the **CONFIGURATION** tab on the left sidebar. -3. Go to **NOTIFICATIONS > LOGS - SYSLOG - IPFIX**. +3. Go to **NOTIFICATIONS → LOGS - SYSLOG - IPFIX**. 4. In the **Syslog** section, ensure the service is enabled by switching the status to **ON**. 5. Select a **Profile** slot to edit (e.g., Profile 1). 6. In the **Syslog server** field, select or create a host object corresponding to the Elastic Agent host. 7. Enter the **Port** number matching your Elastic Agent configuration (e.g., `514` for UDP or `601` for TCP). 8. Select the **Protocol** (**UDP** or **TCP**) that matches your integration input. -9. Choose the **Format**: **RFC5424** is recommended for modern logging, though **Legacy** (BSD) is also supported. +9. Set the **Format** to **RFC5424**. The integration expects RFC5424 messages; the **Legacy** and **Legacy long** formats are not supported at this time. 10. In the **Advanced properties** section, enable the specific log families you wish to send. Ensure **Filter Policy**, **Administration**, **System**, and **Alarms** are active. 11. Click **Apply** to save the syslog configuration. ### Enabling Traffic Logs for Specific Rules: -1. Navigate to **Configuration > Security policy > Filter - NAT**. +1. Navigate to **Configuration → Security policy → Filter - NAT**. 2. Identify the security rules for which you want to collect logs. 3. Double-click a rule to open its properties. 4. Go to the **Action** menu or the General tab. @@ -84,7 +84,7 @@ To configure Stormshield Network Security (SNS) to forward logs to the Elastic A ## Kibana set up steps -1. In Kibana, navigate to **Management > Integrations**. +1. In Kibana, navigate to **Management → Integrations**. 2. Search for and select **StormShield SNS**. 3. Click **Add StormShield SNS**. 4. Configure the inputs based on your SNS configuration: @@ -122,15 +122,15 @@ After configuration is complete, verify that data is flowing correctly. - **Trigger Alarm:** If a test environment is available, attempt a restricted access pattern (such as an Nmap scan) to trigger an intrusion detection alarm. ### 2. Check Data in Kibana: -1. Navigate to **Analytics > Discover**. +1. Navigate to **Analytics → Discover**. 2. Select the `logs-*` data view. 3. Enter the KQL filter: `data_stream.dataset : "stormshield.log"` 4. Verify logs appear. Expand a log entry and confirm these fields: - `event.dataset` (should be `stormshield.log`) - - `source.ip` and/or `destination.ip` - - `event.action` or `event.outcome` + - `source.ip`, `destination.ip`, or both + - `event.action` - `message` (the raw log payload) -5. Navigate to **Analytics > Dashboards** and search for "StormShield SNS" to view pre-built visualizations. +5. Navigate to **Analytics → Dashboards** and search for "StormShield SNS" to view pre-built visualizations. # Troubleshooting diff --git a/packages/stormshield/manifest.yml b/packages/stormshield/manifest.yml index 3b85c8ff526..126f4aeff80 100644 --- a/packages/stormshield/manifest.yml +++ b/packages/stormshield/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.1.1 name: stormshield title: "StormShield SNS" -version: "1.5.2" +version: "1.5.3" source: license: "Elastic-2.0" description: "Stormshield SNS integration." @@ -10,7 +10,6 @@ categories: - network - security - firewall_security - # Added network_security category as Stormshield provides network security protection - network_security conditions: kibana: From 4ce423667ea617fdec7ee88fe4f7317c4405b0ee Mon Sep 17 00:00:00 2001 From: Arnaud RENARD Date: Wed, 8 Jul 2026 17:48:54 +0200 Subject: [PATCH 2/2] [stormshield] Add ECS event categorization and network mappings Set event.kind, event.category and event.type for every SNS log family through a table-driven Painless script keyed on logtype, with allowed/denied event.type modifiers derived case-insensitively from the rule action. The periodic statistics families (monitor, filterstat, count, routerstat, authstat, ipsecstat) are tagged event.kind: metric so health telemetry can be excluded from detection scopes with a single filter. Unknown families fall back to event/network/info, covered by a dedicated test sample. The script only runs on documents without an error, so the pipeline_error kind set by sub-pipeline failure handlers is preserved. Add the ECS network mappings tracked in #10114: rcvd to destination.bytes (mirroring the existing sent mapping), network.bytes as the sum of both, srcif/srcifname/dstif/dstifname copied to observer.ingress and observer.egress interface fields, and network.direction computed with private ranges as internal networks. Promote alarm fields (alarmid to event.code, risk to event.risk_score, pri to event.severity on the alarm scale where 1 is major and 4 is minor), HTTP proxy fields (arg to url.original, url.domain from destination.domain), and populate related.hosts. All mappings are copies; no stormshield.* field moves or changes location. Guard the ASN geoip processors with null checks, matching the geo processors. Fix the count sub-pipeline, which failed on every count log since creation: the script called splitByToken, which does not exist in Painless, and collapsed all rules into a single map. Rule counters are now a sorted array under stormshield.metadata.rule_stats. Extend the metadata move list with the documented alarm, proxy, vpn and auth fields so they land under stormshield.metadata instead of being left unmapped. Add pipeline test samples for the alarm, auth, web, vpn, xvpn, count and filter families, derived from the log format examples in the official Stormshield documentation with sanitized addresses, including uppercase and empty action values. Add an Alarms (IPS) dashboard keyed on the new categorization fields. Document the categorization table in the README. --- .../stormshield/_dev/build/docs/README.md | 34 + packages/stormshield/changelog.yml | 17 + .../pipeline/test-firewall.log-expected.json | 429 ++++++- .../_dev/test/pipeline/test-log-families.log | 13 + .../test-log-families.log-expected.json | 1089 +++++++++++++++++ .../elasticsearch/ingest_pipeline/count.yml | 50 +- .../elasticsearch/ingest_pipeline/default.yml | 214 +++- .../data_stream/log/fields/ecs.yml | 34 + .../data_stream/log/sample_event.json | 29 +- packages/stormshield/docs/README.md | 79 +- ...-3f2a9c60-1a4e-11f1-9adf-0242ac120002.json | 1060 ++++++++++++++++ packages/stormshield/manifest.yml | 2 +- 12 files changed, 2979 insertions(+), 71 deletions(-) create mode 100644 packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log create mode 100644 packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log-expected.json create mode 100644 packages/stormshield/kibana/dashboard/stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002.json diff --git a/packages/stormshield/_dev/build/docs/README.md b/packages/stormshield/_dev/build/docs/README.md index b7d36d070ed..0bb75ffe8de 100644 --- a/packages/stormshield/_dev/build/docs/README.md +++ b/packages/stormshield/_dev/build/docs/README.md @@ -207,6 +207,40 @@ For more information on architectures that can be used for scaling this integrat You'll find events from Stormshield SNS logs in the `log` data stream. This data stream includes logs of the following types: traffic, filter, protection, and system events. +##### ECS event categorization + +Each log family (identified by the `logtype` field) is mapped to the ECS categorization fields. Alarms raised by the intrusion prevention engine produce `event.kind: alert`. The periodic statistics families (`monitor`, `filterstat`, `count`, `routerstat`, `authstat`, `ipsecstat`) produce `event.kind: metric`, so health telemetry can be excluded from detection rule scopes with a single filter. All other families produce `event.kind: event`. + +| logtype | event.kind | event.category | event.type | +|---|---|---|---| +| alarm | alert | intrusion_detection, network | info | +| auth | event | authentication | start | +| authstat | metric | authentication | info | +| connection | event | network, session | connection, end | +| count, filterstat, ipsecstat, routerstat | metric | network | info | +| date | event | host | change | +| dmrouting, routing | event | network, host | change | +| filter | event | network | connection | +| ftp | event | network | info | +| monitor | metric | host | info | +| plugin | event | network | protocol | +| pop3, smtp | event | email, network | info | +| pvm | event | vulnerability | info | +| restapi | event | web, configuration | access | +| sandboxing | event | network | info | +| server | event | configuration | access | +| ssl | event | network | connection | +| system | event | host | info | +| vpn | event | network | info | +| web | event | web, network | access | +| xvpn | event | network, session | connection | + +For the families that carry a rule action, `event.type` additionally receives `allowed` when the action is `pass` and `denied` when the action is `block` (matched case-insensitively). An empty action field corresponds to a rule set to Log, and no modifier is added. Unknown log families fall back to `event.kind: event` with `event.category: network` and `event.type: info`. + +For alarm logs, `event.code` carries the Stormshield alarm identifier, `event.risk_score` the `risk` field (1-100), and `event.severity` the vendor alarm level from `pri`, where 1 is a major alarm and 4 a minor alarm. This scale is specific to the alarm family. In most other families, the appliance hardcodes the `pri` field to 5. + +`network.direction` is computed from the source and destination IP addresses, treating private (RFC 1918) address ranges as internal networks. + ##### `log` fields You'll find a list of all exported fields in the following table: diff --git a/packages/stormshield/changelog.yml b/packages/stormshield/changelog.yml index 7cc80809f3f..381c594d6bb 100644 --- a/packages/stormshield/changelog.yml +++ b/packages/stormshield/changelog.yml @@ -1,4 +1,21 @@ # newer versions go on top +- version: "1.6.0" + changes: + - description: Set ECS event categorization fields (`event.kind`, `event.category`, `event.type`) for every log family, including `event.kind` `metric` for the periodic statistics families. + type: enhancement + link: https://github.com/elastic/integrations/pull/20031 + - description: Map `rcvd` to `destination.bytes`, sum `network.bytes`, map interface fields to `observer.ingress` and `observer.egress`, compute `network.direction`, and populate `related.hosts`. + type: enhancement + link: https://github.com/elastic/integrations/pull/20031 + - description: Map alarm identifiers and levels to `event.code`, `event.risk_score` and `event.severity`, and HTTP proxy fields to `url.original` and `url.domain`. + type: enhancement + link: https://github.com/elastic/integrations/pull/20031 + - description: Fix the count sub-pipeline, which failed with a Painless runtime error on every count log, and skip malformed counters instead of failing the whole document. + type: bugfix + link: https://github.com/elastic/integrations/pull/20031 + - description: Add an Alarms dashboard and pipeline test samples for the alarm, auth, web, vpn, xvpn, count and filter log families. + type: enhancement + link: https://github.com/elastic/integrations/pull/20031 - version: "1.5.3" changes: - description: Fix ingest pipeline descriptions and remove field definitions that never appear in events (`stormshield.tz`, `stormshield.duration`, `stormshield.msg`, `stormshield.origdst`, `stormshield.origdstport`). diff --git a/packages/stormshield/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json index 3baa9b1deaa..deea33719c5 100644 --- a/packages/stormshield/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json +++ b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json @@ -6,9 +6,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "network" + ], + "kind": "metric", "original": "id=firewall time=\"2024-03-08 17:29:51\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 17:29:51\" SavedEvaluation=621 DynamicMem=0 HostMem=0 FragMem=0 ICMPMem=0 ConnMem=0 AssocMem=0 EtherStateMem=0 IPStateMem=0 DTrackMem=0 Logged=11 LogOverflow=0 HostrepMax=0 HostrepScore=0 HostrepRequests=0 PvmFacts=0 PvmOverflow=0 Accepted=105 Blocked=0 Byte(i/o)=10592/14285 Fragmented=0 TCPPacket=0 TCPByte(i/o)=0/0 TCPConn=0 TCPConnNatSrc=0 TCPConnNatDst=0 TCPConnNoNatSrc=0 TCPConnNoNatDst=0 UDPPacket=104 UDPByte(i/o)=10283/14285 UDPConn=0 UDPConnNatSrc=0 UDPConnNatDst=0 UDPConnNoNatSrc=0 UDPConnNoNatDst=0 ICMPPacket=1 ICMPByte(i/o)=309/0 IPStatePacket=0 IPStateByte(i/o)=0/0 IPStateConn=0 IPStateConnNatSrc=0 IPStateConnNatDst=0 IPStateConnNoNatSrc=0 IPStateConnNoNatDst=0 SCTPAssocPacket=0 SCTPAssocByte(i/o)=0/0 SCTPAssoc=0 EtherStatePacket=0 EtherStateByte(i/o)=0/0 EtherStateConn=0 TLSCertCacheEntriesNb=0 TLSCertCacheLookup(miss/total)=0/0 TLSCertCacheInsert=0 TLSCertCacheFlushOp=0 TLSCertCachePurgeOp=0 TLSCertCacheFlushedNb=0 TLSCertCachePurgedNb=0 TLSCertCacheExpiredNb=0 logtype=\"filterstat\"", "start": "2024-03-08T17:29:51.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "observer": { "name": "stormy-1", @@ -121,6 +128,7 @@ "name": "Bredband2 AB" } }, + "bytes": 48, "domain": "ntp2.stormshieldcs.eu", "geo": { "city_name": "Linköping", @@ -146,22 +154,44 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 90000000, + "kind": "event", "original": "id=firewall time=\"2024-03-08 17:29:30\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 12:27:28\" pri=5 confid=01 slotlevel=0 ruleid=7 ipproto=udp dstif=\"Ethernet0\" dstifname=\"out\" proto=ntp src=192.168.197.134 srcport=123 srcportname=ntp srcname=Firewall_out dst=1.128.0.1 dstport=123 dstportname=ntp dstname=ntp2.stormshieldcs.eu dstcontinent=\"eu\" dstcountry=\"fr\" modsrc=192.168.197.134 modsrcport=123 origdst=89.160.20.182 origdstport=123 ipv=4 sent=48 rcvd=48 duration=0.09 action=pass logtype=\"connection\"", "start": "2024-03-08T12:27:28.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 96, + "direction": "outbound", "protocol": "ntp", "transport": "udp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out", + "ntp2.stormshieldcs.eu" + ], "ip": [ "192.168.197.134", "89.160.20.182", @@ -207,9 +237,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "authentication" + ], + "kind": "metric", "original": "id=firewall time=\"2024-03-08 17:30:58\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 17:30:58\" auth=0 authtotp=0 authcaptive=0 authwebadmin=0 authsslvpn=0 authipsec=0 authconsole=0 logtype=\"authstat\"", "start": "2024-03-08T17:30:58.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "observer": { "name": "stormy-1", @@ -242,9 +279,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "metric", "original": "id=firewall time=\"2024-03-08 17:31:09\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 17:31:09\" security=0 system=0 CPU=1,1,1 Pvm=0,0,0,0,0,0,0,0,0,0,0 sslvpn1=sslvpn_udp,0,0,0,0,0,0 sslvpn0=sslvpn,0,0,0,0,0,0 ipsec=ipsec,0,0,0,0,0,0 Ethernet1=in,8,40,8,40,0,0 Ethernet0=out,86,424,177,536,75,0 Qid0=BYPASS_out,0,16032,0,0,82,0 Qid1=BYPASS_in,0,656,0,0,0,0 Qid2=BYPASS_ipsec,0,0,0,0,0,0 mem=0,0,0,0,0,0,0,0 logtype=\"monitor\"", "start": "2024-03-08T17:31:09.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "observer": { "name": "stormy-1", @@ -371,9 +415,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 18:14:59\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 18:14:59\" pri=5 service=userreqd msg=\"reloading daemon configuration (reason: SIGHUP)\" logtype=\"system\"", "start": "2024-03-08T18:14:59.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "reloading daemon configuration (reason: SIGHUP)", "observer": { @@ -402,9 +453,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 18:15:00\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 18:15:00\" pri=5 service=routerd msg=\"routerd daemon configuration reloaded, modules: pbr_route, ip_version: all (reason: Refresh)\" logtype=\"system\"", "start": "2024-03-08T18:15:00.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "routerd daemon configuration reloaded, modules: pbr_route, ip_version: all (reason: Refresh)", "observer": { @@ -430,6 +488,7 @@ { "@timestamp": "2019-02-24T16:38:01.000+01:00", "destination": { + "bytes": 0, "ip": "10.10.10.10", "port": 1900 }, @@ -438,22 +497,41 @@ }, "event": { "action": "pass", + "category": [ + "network" + ], "duration": 0, + "kind": "event", "original": "id=firewall time=\"2019-02-24 16:38:01\" fw=\"SN310A17B0323A7\" tz=+0100 startime=\"2019-02-24 16:38:00\" pri=5 confid=00 slotlevel=2 ruleid=4 rulename=\"1690fb96019_7\" srcif=\"Ethernet0\" srcifname=\"out\" ipproto=udp proto=ssdp src=10.11.11.11 srcport=49907 srcportname=ephemeral_fw_udp srcname=user1 srcmac=11:11:11:11:11:11 dst=10.10.10.10 dstport=1900 dstportname=sdp ipv=4 sent=0 rcvd=0 duration=0.00 action=pass logtype=\"filter\"", "start": "2019-02-24T16:38:00.000+01:00", - "timezone": "+01:00" + "timezone": "+01:00", + "type": [ + "connection", + "allowed" + ] }, "network": { + "bytes": 0, + "direction": "internal", "protocol": "ssdp", "transport": "udp", "type": "ipv4" }, "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "SN310A17B0323A7", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "user1" + ], "ip": [ "10.11.11.11", "10.10.10.10" @@ -498,9 +576,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"CONFIG LOG SHOW\" logtype=\"server\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "CONFIG LOG SHOW", "observer": { @@ -538,9 +623,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"PKI SEARCH scope=local type=ca\" logtype=\"server\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "PKI SEARCH scope=local type=ca", "observer": { @@ -575,6 +667,7 @@ { "@timestamp": "2024-03-08T10:14:08.000Z", "destination": { + "bytes": 3614, "domain": "Firewall_out", "ip": "192.168.197.134", "port": 443 @@ -584,22 +677,43 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 10000000, + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" pri=5 confid=00 slotlevel=0 ruleid=4 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp proto=ssl version=TLSv1.3 src=192.168.197.1 srcport=61549 srcportname=ad2008-dyn_tcp srcmac=00:50:56:c0:00:08 dst=192.168.197.134 dstport=443 dstportname=https dstname=Firewall_out modsrc=192.168.197.1 modsrcport=61549 origdst=192.168.197.134 origdstport=443 ipv=4 sent=605 rcvd=3614 duration=0.01 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 4219, + "direction": "internal", "protocol": "ssl", "transport": "tcp", "type": "ipv4" }, "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out" + ], "ip": [ "192.168.197.1", "192.168.197.134" @@ -643,9 +757,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"SYSTEM LOGDISK LIST\" logtype=\"server\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "SYSTEM LOGDISK LIST", "observer": { @@ -683,9 +804,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"CONFIG COMMUNICATION SYSLOG PROFILE SHOW index=0\" logtype=\"server\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "CONFIG COMMUNICATION SYSLOG PROFILE SHOW index=0", "observer": { @@ -720,6 +848,7 @@ { "@timestamp": "2024-03-08T10:14:08.000Z", "destination": { + "bytes": 3614, "domain": "Firewall_out", "ip": "192.168.197.134", "port": 443 @@ -729,22 +858,43 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 320000000, + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" pri=5 confid=00 slotlevel=0 ruleid=4 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp proto=ssl version=TLSv1.3 src=192.168.197.1 srcport=61548 srcportname=ad2008-dyn_tcp srcmac=00:50:56:c0:00:08 dst=192.168.197.134 dstport=443 dstportname=https dstname=Firewall_out modsrc=192.168.197.1 modsrcport=61548 origdst=192.168.197.134 origdstport=443 ipv=4 sent=573 rcvd=3614 duration=0.32 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 4187, + "direction": "internal", "protocol": "ssl", "transport": "tcp", "type": "ipv4" }, "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out" + ], "ip": [ "192.168.197.1", "192.168.197.134" @@ -785,6 +935,7 @@ { "@timestamp": "2024-03-08T10:14:08.000Z", "destination": { + "bytes": 3614, "domain": "Firewall_out", "ip": "192.168.197.134", "port": 443 @@ -794,22 +945,43 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 320000000, + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" pri=5 confid=00 slotlevel=0 ruleid=4 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp proto=ssl version=TLSv1.3 src=192.168.197.1 srcport=61550 srcportname=ad2008-dyn_tcp srcmac=00:50:56:c0:00:08 dst=192.168.197.134 dstport=443 dstportname=https dstname=Firewall_out modsrc=192.168.197.1 modsrcport=61550 origdst=192.168.197.134 origdstport=443 ipv=4 sent=605 rcvd=3614 duration=0.32 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 4219, + "direction": "internal", "protocol": "ssl", "transport": "tcp", "type": "ipv4" }, "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out" + ], "ip": [ "192.168.197.1", "192.168.197.134" @@ -850,6 +1022,7 @@ { "@timestamp": "2024-03-08T10:14:09.000Z", "destination": { + "bytes": 300, "ip": "192.168.236.254", "port": 67 }, @@ -858,22 +1031,43 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 0, + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:09\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:12:09\" pri=5 confid=01 slotlevel=0 ruleid=7 ipproto=udp dstif=\"Ethernet1\" dstifname=\"in\" proto=bootps src=192.168.236.131 srcport=68 srcportname=bootpc srcname=Firewall_in dst=192.168.236.254 dstport=67 dstportname=bootps modsrc=192.168.236.131 modsrcport=68 origdst=192.168.236.254 origdstport=67 ipv=4 sent=300 rcvd=300 duration=0.00 action=pass logtype=\"connection\"", "start": "2024-03-08T10:12:09.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 600, + "direction": "internal", "protocol": "bootps", "transport": "udp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, "name": "stormy-1", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_in" + ], "ip": [ "192.168.236.131", "192.168.236.254" @@ -916,9 +1110,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:11\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:11\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"CONFIG ACTIVATE cancelall\" logtype=\"server\"", "start": "2024-03-08T10:14:11.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "CONFIG ACTIVATE cancelall", "observer": { @@ -956,9 +1157,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:11\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:11\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"SYSTEM IDENT\" logtype=\"server\"", "start": "2024-03-08T10:14:11.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "SYSTEM IDENT", "observer": { @@ -996,9 +1204,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:11\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:11\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"SYSTEM LANGUAGE\" logtype=\"server\"", "start": "2024-03-08T10:14:11.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "SYSTEM LANGUAGE", "observer": { @@ -1036,9 +1251,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:48\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:48\" pri=5 service=routerd msg=\"The gateway of the router is now used for routing router:Firewall_out_router gateway:Firewall_out_router ipv:4 (192.168.197.2)\" logtype=\"system\"", "start": "2024-03-08T15:14:48.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "The gateway of the router is now used for routing router:Firewall_out_router gateway:Firewall_out_router ipv:4 (192.168.197.2)", "observer": { @@ -1067,9 +1289,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:48\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:48\" pri=5 service=routerd msg=\"routerd daemon configuration reloaded, modules: pbr_route, ip_version: all (reason: Refresh)\" logtype=\"system\"", "start": "2024-03-08T15:14:48.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "routerd daemon configuration reloaded, modules: pbr_route, ip_version: all (reason: Refresh)", "observer": { @@ -1098,9 +1327,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:48\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:48\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"CONFIG DNS ACTIVATE\" logtype=\"server\"", "start": "2024-03-08T15:14:48.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "CONFIG DNS ACTIVATE", "observer": { @@ -1141,11 +1377,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "code": "82", + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:49\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:48\" pri=5 src=192.168.197.2 dst=0.0.0.0 msg=\"Remote host reachable: through Firewall_out_router(192.168.197.2) on router Firewall_out_router\" service=sysevent alarmid=82 logtype=\"system\"", "start": "2024-03-08T15:14:48.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "Remote host reachable: through Firewall_out_router(192.168.197.2) on router Firewall_out_router", + "network": { + "direction": "outbound" + }, "observer": { "name": "stormy-1", "type": "firewall", @@ -1182,9 +1429,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "network" + ], + "kind": "metric", "original": "id=firewall time=\"2024-03-08 15:14:51\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:51\" SavedEvaluation=153 DynamicMem=0 HostMem=0 FragMem=0 ICMPMem=0 ConnMem=0 AssocMem=0 EtherStateMem=0 IPStateMem=0 DTrackMem=0 Logged=10 LogOverflow=0 HostrepMax=0 HostrepScore=0 HostrepRequests=0 PvmFacts=0 PvmOverflow=0 Accepted=289 Blocked=0 Byte(i/o)=97364/145065 Fragmented=0 TCPPacket=178 TCPByte(i/o)=86297/116839 TCPConn=3 TCPConnNatSrc=0 TCPConnNatDst=0 TCPConnNoNatSrc=0 TCPConnNoNatDst=0 UDPPacket=111 UDPByte(i/o)=11067/28226 UDPConn=0 UDPConnNatSrc=0 UDPConnNatDst=0 UDPConnNoNatSrc=0 UDPConnNoNatDst=0 ICMPPacket=0 ICMPByte(i/o)=0/0 IPStatePacket=0 IPStateByte(i/o)=0/0 IPStateConn=0 IPStateConnNatSrc=0 IPStateConnNatDst=0 IPStateConnNoNatSrc=0 IPStateConnNoNatDst=0 SCTPAssocPacket=0 SCTPAssocByte(i/o)=0/0 SCTPAssoc=0 EtherStatePacket=0 EtherStateByte(i/o)=0/0 EtherStateConn=0 TLSCertCacheEntriesNb=0 TLSCertCacheLookup(miss/total)=0/0 TLSCertCacheInsert=0 TLSCertCacheFlushOp=0 TLSCertCachePurgeOp=0 TLSCertCacheFlushedNb=0 TLSCertCachePurgedNb=0 TLSCertCacheExpiredNb=0 logtype=\"filterstat\"", "start": "2024-03-08T15:14:51.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "observer": { "name": "stormy-1", @@ -1294,9 +1548,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:54\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:54\" pri=5 service=userreqd msg=\"reloading daemon configuration (reason: SIGHUP)\" logtype=\"system\"", "start": "2024-03-08T15:14:54.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "reloading daemon configuration (reason: SIGHUP)", "observer": { @@ -1325,9 +1586,17 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "code": "41", + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:55\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:54\" pri=5 msg=\"Active Update: update successful IPData\" service=sysevent alarmid=41 logtype=\"system\"", "start": "2024-03-08T10:14:54.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "Active Update: update successful IPData", "observer": { @@ -1357,9 +1626,16 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:56\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:56\" error=1 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"QUIT\" logtype=\"server\"", "start": "2024-03-08T15:14:56.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "QUIT", "observer": { @@ -1397,9 +1673,19 @@ "version": "8.17.0" }, "event": { + "category": [ + "intrusion_detection", + "network" + ], + "code": "3", + "kind": "alert", "original": "id=firewall time=\"2024-03-08 15:14:57\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:56\" pri=4 msg=\"Connection terminated for webadmin (timeout)\" class=system alarmid=3 logtype=\"alarm\"", + "severity": 4, "start": "2024-03-08T10:14:56.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "Connection terminated for webadmin (timeout)", "observer": { @@ -1426,6 +1712,7 @@ { "@timestamp": "2024-03-08T15:14:57.000Z", "destination": { + "bytes": 921861, "domain": "update2-sns.stormshieldcs.eu", "geo": { "country_iso_code": "fr" @@ -1438,22 +1725,44 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 2147483647, + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:57\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:51\" pri=5 confid=01 slotlevel=0 ruleid=7 ipproto=tcp dstif=\"Ethernet0\" dstifname=\"out\" proto=https src=192.168.197.134 srcport=19883 srcname=Firewall_out dst=192.168.36.20 dstport=443 dstportname=https dstname=update2-sns.stormshieldcs.eu dstcontinent=\"eu\" dstcountry=\"fr\" modsrc=192.168.197.134 modsrcport=19883 origdst=192.168.36.20 origdstport=443 ipv=4 sent=3721 rcvd=921861 duration=5.52 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:51.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 925582, + "direction": "internal", "protocol": "https", "transport": "tcp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out", + "update2-sns.stormshieldcs.eu" + ], "ip": [ "192.168.197.134", "192.168.36.20" @@ -1493,6 +1802,7 @@ { "@timestamp": "2024-03-08T15:14:57.000Z", "destination": { + "bytes": 4863757, "domain": "update1-sns.stormshieldcs.eu", "geo": { "country_iso_code": "fr" @@ -1505,22 +1815,44 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 2147483647, + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:57\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:54\" pri=5 confid=01 slotlevel=0 ruleid=7 ipproto=tcp dstif=\"Ethernet0\" dstifname=\"out\" proto=https src=192.168.197.134 srcport=15908 srcname=Firewall_out dst=192.168.36.4 dstport=443 dstportname=https dstname=update1-sns.stormshieldcs.eu dstcontinent=\"eu\" dstcountry=\"fr\" modsrc=192.168.197.134 modsrcport=15908 origdst=192.168.36.4 origdstport=443 ipv=4 sent=1467 rcvd=4863757 duration=2.98 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:54.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 4865224, + "direction": "internal", "protocol": "https", "transport": "tcp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out", + "update1-sns.stormshieldcs.eu" + ], "ip": [ "192.168.197.134", "192.168.36.4" @@ -1563,9 +1895,17 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "code": "41", + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:58\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:56\" pri=5 msg=\"Active Update: update successful CompromisedUrls\" service=sysevent logtype=\"system\" alarmid=41", "start": "2024-03-08T10:14:56.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "Active Update: update successful CompromisedUrls", "observer": { @@ -1598,6 +1938,7 @@ "name": "Telstra Pty Ltd" } }, + "bytes": 177, "domain": "connectivity-check.ubuntu.com", "geo": { "country_iso_code": "us" @@ -1610,22 +1951,48 @@ }, "event": { "action": "pass", + "category": [ + "network" + ], "duration": 60000000, + "kind": "event", "original": "id=firewall time=\"2024-06-07 18:46:18\" fw=\"stormy-1\" tz=+0000 startime=\"2024-06-07 10:40:42\" pri=5 confid=01 slotlevel=2 ruleid=7 srcif=\"Ethernet1\" srcifname=\"segment0\" ipproto=tcp dstif=\"Ethernet0\" dstifname=\"out\" proto=http src=89.160.20.128 srcport=55008 srcportname=ephemeral_fw_tcp srcname=vm-internal srcmac=00:0c:29:8d:6c:55 srccontinent=\"eu\" srccountry=\"se\" dst=1.128.91.48 dstport=80 dstportname=http dstname=connectivity-check.ubuntu.com dstcontinent=\"na\" dstcountry=\"us\" modsrc=192.168.197.134 modsrcport=55008 origdst=1.128.91.48 origdstport=80 ipv=4 sent=77 rcvd=177 duration=0.06 action=pass op=GET result=204 arg=\"/\" logtype=\"plugin\"", "start": "2024-06-07T10:40:42.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "protocol", + "allowed" + ] }, "network": { + "bytes": 254, + "direction": "external", "protocol": "http", "transport": "tcp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "segment0" + } + }, "name": "stormy-1", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "vm-internal", + "connectivity-check.ubuntu.com" + ], "ip": [ "89.160.20.128", "192.168.197.134", diff --git a/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log new file mode 100644 index 00000000000..6eb52c08c22 --- /dev/null +++ b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log @@ -0,0 +1,13 @@ +id=firewall time="2019-01-27 13:24:28" fw="V50XXA0G0000002" tz=+0000 startime="2019-01-27 13:24:28" pri=4 srcif="Ethernet0" srcifname="out" ipproto=tcp proto=ssh src=192.168.0.1 srcport=54937 srcportname=ephemeral_fw dst=192.168.1.1 dstport=22 dstportname=ssh dstname=Firewall_out action=pass msg="Interactive connection detected" class=protocol classification=0 alarmid=85 logtype="alarm" +id=firewall time="2026-03-02 11:05:33" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 11:05:33" pri=1 class=protocol classification=0 alarmid=157 sensible=1 risk=85 target=dst repeat=3 srcif="Ethernet1" srcifname="in" ipproto=tcp proto=http src=192.0.2.10 srcport=51234 srcportname=ephemeral_fw_tcp dst=192.0.2.80 dstport=80 dstportname=http ipv=4 action=block msg="Possible port scan" logtype="alarm" +id=firewall time="2026-03-02 09:12:41" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 09:12:41" user="jdoe" domain="documentation" src=192.0.2.25 ruleid=2 confid=00 error=0 method="" totp=no msg="User authenticated" logtype="auth" +id=firewall time="2026-03-02 09:13:05" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 09:13:05" user="jdoe" domain="documentation" src=192.0.2.25 ruleid=2 confid=00 error=1 msg="Authentication failed" logtype="auth" +id=firewall time="2026-03-02 10:30:12" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 10:30:11" pri=5 srcif="Ethernet1" srcifname="in" ipproto=tcp proto=http src=192.168.10.25 srcport=52000 srcportname=ephemeral_fw_tcp dst=198.51.100.20 dstport=80 dstportname=http dstname=www.example.com modsrc=203.0.113.1 modsrcport=52000 origdst=198.51.100.20 origdstport=80 ipv=4 sent=512 rcvd=2048 duration=0.42 user="jdoe" op=GET result=200 arg="/index.html" cat_site="{news}" contentpolicy=00 action=pass logtype="web" +id=firewall time="2026-03-02 10:31:44" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 10:31:44" pri=5 srcif="Ethernet1" srcifname="in" ipproto=tcp proto=http src=192.168.10.25 srcport=52014 srcportname=ephemeral_fw_tcp dst=198.51.100.30 dstport=80 dstportname=http dstname=blocked.example.com ipv=4 sent=256 rcvd=0 duration=0.05 user="jdoe" op=GET result=403 arg="/download.exe" cat_site="{malware}" contentpolicy=00 action=Block logtype="web" +id=firewall time="2026-03-02 08:00:05" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 08:00:03" pri=5 phase=1 side=initiator ikev=2 remoteid=203.0.113.50 cookie_i=0x45718953174ba1b9 cookie_r=0x93b571aa2f43d0d1 src=203.0.113.1 srcname=Firewall_out dst=203.0.113.50 dstname=remote_gateway msg="Phase established" logtype="vpn" +id=firewall time="2026-03-02 08:00:06" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 08:00:05" pri=5 phase=2 side=responder ikev=2 spi_in=0x0c9f2ea1 spi_out=0x1a4b3c2d localnet=192.168.1.0/24 remotenet=192.168.2.0/24 src=203.0.113.1 srcname=Firewall_out dst=203.0.113.50 dstname=remote_gateway msg="Phase established" logtype="vpn" +id=firewall time="2026-03-02 12:00:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 12:00:00" Rule2:8=1612 Rule1:3=245781 logtype="count" +id=firewall time="2026-03-02 12:05:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 12:05:00" Rule2:8=abc Rule9:12=77 Rule1:3:5=9 Rule0:2=512 logtype="count" +id=firewall time="2026-03-02 09:45:22" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 09:45:22" user="jdoe" domain="documentation" error=0 src=203.0.113.77 srcname=remote_laptop msg="SSL VPN tunnel opened" duration=0 totp=yes logtype="xvpn" +id=firewall time="2026-03-02 14:20:10" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 14:20:10" pri=5 confid=00 slotlevel=2 ruleid=12 srcif="Ethernet1" srcifname="in" ipproto=udp src=192.0.2.30 srcport=5353 dst=192.0.2.251 dstport=5353 dstportname=mdns ipv=4 action= logtype="filter" +id=firewall time="2026-03-02 15:00:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 15:00:00" pri=5 msg="sample from a log family unknown to the categorization table" logtype="futuretype" diff --git a/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log-expected.json b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log-expected.json new file mode 100644 index 00000000000..61734826c7d --- /dev/null +++ b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log-expected.json @@ -0,0 +1,1089 @@ +{ + "expected": [ + { + "@timestamp": "2019-01-27T13:24:28.000Z", + "destination": { + "domain": "Firewall_out", + "ip": "192.168.1.1", + "port": 22 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "pass", + "category": [ + "intrusion_detection", + "network" + ], + "code": "85", + "kind": "alert", + "original": "id=firewall time=\"2019-01-27 13:24:28\" fw=\"V50XXA0G0000002\" tz=+0000 startime=\"2019-01-27 13:24:28\" pri=4 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp proto=ssh src=192.168.0.1 srcport=54937 srcportname=ephemeral_fw dst=192.168.1.1 dstport=22 dstportname=ssh dstname=Firewall_out action=pass msg=\"Interactive connection detected\" class=protocol classification=0 alarmid=85 logtype=\"alarm\"", + "severity": 4, + "start": "2019-01-27T13:24:28.000Z", + "timezone": "+00:00", + "type": [ + "info", + "allowed" + ] + }, + "message": "Interactive connection detected", + "network": { + "direction": "internal", + "protocol": "ssh", + "transport": "tcp" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, + "name": "V50XXA0G0000002", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "Firewall_out" + ], + "ip": [ + "192.168.0.1", + "192.168.1.1" + ] + }, + "source": { + "ip": "192.168.0.1", + "port": 54937 + }, + "stormshield": { + "fw": "V50XXA0G0000002", + "logtype": "alarm", + "metadata": { + "alarmid": "85", + "class": "protocol", + "classification": "0", + "dstportname": "ssh", + "id": "firewall", + "pri": "4", + "srcportname": "ephemeral_fw" + }, + "srcif": "Ethernet0", + "srcifname": "out", + "startime": "2019-01-27 13:24:28", + "time": "2019-01-27 13:24:28" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T11:05:33.000+01:00", + "destination": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.80", + "port": 80 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "block", + "category": [ + "intrusion_detection", + "network" + ], + "code": "157", + "kind": "alert", + "original": "id=firewall time=\"2026-03-02 11:05:33\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 11:05:33\" pri=1 class=protocol classification=0 alarmid=157 sensible=1 risk=85 target=dst repeat=3 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=tcp proto=http src=192.0.2.10 srcport=51234 srcportname=ephemeral_fw_tcp dst=192.0.2.80 dstport=80 dstportname=http ipv=4 action=block msg=\"Possible port scan\" logtype=\"alarm\"", + "risk_score": 85.0, + "severity": 1, + "start": "2026-03-02T11:05:33.000+01:00", + "timezone": "+01:00", + "type": [ + "info", + "denied" + ] + }, + "message": "Possible port scan", + "network": { + "direction": "external", + "protocol": "http", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.10", + "192.0.2.80" + ] + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10", + "port": 51234 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "alarm", + "metadata": { + "alarmid": "157", + "class": "protocol", + "classification": "0", + "dstportname": "http", + "id": "firewall", + "pri": "1", + "repeat": "3", + "risk": "85", + "sensible": "1", + "srcportname": "ephemeral_fw_tcp", + "target": "dst" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 11:05:33", + "time": "2026-03-02 11:05:33" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T09:12:41.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "authentication" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 09:12:41\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 09:12:41\" user=\"jdoe\" domain=\"documentation\" src=192.0.2.25 ruleid=2 confid=00 error=0 method=\"\" totp=no msg=\"User authenticated\" logtype=\"auth\"", + "start": "2026-03-02T09:12:41.000+01:00", + "timezone": "+01:00", + "type": [ + "start" + ] + }, + "message": "User authenticated", + "observer": { + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.25" + ], + "user": [ + "jdoe" + ] + }, + "rule": { + "id": "2" + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.25" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "auth", + "metadata": { + "confid": "00", + "domain": "documentation", + "error": "0", + "id": "firewall", + "method": "", + "totp": "no" + }, + "startime": "2026-03-02 09:12:41", + "time": "2026-03-02 09:12:41" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T09:13:05.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "authentication" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 09:13:05\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 09:13:05\" user=\"jdoe\" domain=\"documentation\" src=192.0.2.25 ruleid=2 confid=00 error=1 msg=\"Authentication failed\" logtype=\"auth\"", + "start": "2026-03-02T09:13:05.000+01:00", + "timezone": "+01:00", + "type": [ + "start" + ] + }, + "message": "Authentication failed", + "observer": { + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.25" + ], + "user": [ + "jdoe" + ] + }, + "rule": { + "id": "2" + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.25" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "auth", + "metadata": { + "confid": "00", + "domain": "documentation", + "error": "1", + "id": "firewall" + }, + "startime": "2026-03-02 09:13:05", + "time": "2026-03-02 09:13:05" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T10:30:12.000+01:00", + "destination": { + "as": { + "number": 64501, + "organization": { + "name": "Documentation ASN" + } + }, + "bytes": 2048, + "domain": "www.example.com", + "geo": { + "city_name": "Amsterdam", + "continent_name": "Europe", + "country_iso_code": "NL", + "country_name": "Netherlands", + "location": { + "lat": 52.37404, + "lon": 4.88969 + }, + "region_iso_code": "NL-NH", + "region_name": "North Holland" + }, + "ip": "198.51.100.20", + "port": 80 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "pass", + "category": [ + "web", + "network" + ], + "duration": 420000000, + "kind": "event", + "original": "id=firewall time=\"2026-03-02 10:30:12\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 10:30:11\" pri=5 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=tcp proto=http src=192.168.10.25 srcport=52000 srcportname=ephemeral_fw_tcp dst=198.51.100.20 dstport=80 dstportname=http dstname=www.example.com modsrc=203.0.113.1 modsrcport=52000 origdst=198.51.100.20 origdstport=80 ipv=4 sent=512 rcvd=2048 duration=0.42 user=\"jdoe\" op=GET result=200 arg=\"/index.html\" cat_site=\"{news}\" contentpolicy=00 action=pass logtype=\"web\"", + "start": "2026-03-02T10:30:11.000+01:00", + "timezone": "+01:00", + "type": [ + "access", + "allowed" + ] + }, + "network": { + "bytes": 2560, + "direction": "outbound", + "protocol": "http", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "www.example.com" + ], + "ip": [ + "192.168.10.25", + "203.0.113.1", + "198.51.100.20" + ], + "user": [ + "jdoe" + ] + }, + "source": { + "bytes": 512, + "ip": "192.168.10.25", + "nat": { + "ip": "203.0.113.1", + "port": 52000 + }, + "port": 52000 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "web", + "metadata": { + "arg": "/index.html", + "cat_site": "{news}", + "contentpolicy": "00", + "dstportname": "http", + "id": "firewall", + "op": "GET", + "pri": "5", + "rcvd": "2048", + "result": "200", + "sent": "512", + "srcportname": "ephemeral_fw_tcp" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 10:30:11", + "time": "2026-03-02 10:30:12" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "www.example.com", + "original": "/index.html" + }, + "user": { + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T10:31:44.000+01:00", + "destination": { + "as": { + "number": 64501, + "organization": { + "name": "Documentation ASN" + } + }, + "bytes": 0, + "domain": "blocked.example.com", + "geo": { + "city_name": "Amsterdam", + "continent_name": "Europe", + "country_iso_code": "NL", + "country_name": "Netherlands", + "location": { + "lat": 52.37404, + "lon": 4.88969 + }, + "region_iso_code": "NL-NH", + "region_name": "North Holland" + }, + "ip": "198.51.100.30", + "port": 80 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Block", + "category": [ + "web", + "network" + ], + "duration": 50000000, + "kind": "event", + "original": "id=firewall time=\"2026-03-02 10:31:44\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 10:31:44\" pri=5 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=tcp proto=http src=192.168.10.25 srcport=52014 srcportname=ephemeral_fw_tcp dst=198.51.100.30 dstport=80 dstportname=http dstname=blocked.example.com ipv=4 sent=256 rcvd=0 duration=0.05 user=\"jdoe\" op=GET result=403 arg=\"/download.exe\" cat_site=\"{malware}\" contentpolicy=00 action=Block logtype=\"web\"", + "start": "2026-03-02T10:31:44.000+01:00", + "timezone": "+01:00", + "type": [ + "access", + "denied" + ] + }, + "network": { + "bytes": 256, + "direction": "outbound", + "protocol": "http", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "blocked.example.com" + ], + "ip": [ + "192.168.10.25", + "198.51.100.30" + ], + "user": [ + "jdoe" + ] + }, + "source": { + "bytes": 256, + "ip": "192.168.10.25", + "port": 52014 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "web", + "metadata": { + "arg": "/download.exe", + "cat_site": "{malware}", + "contentpolicy": "00", + "dstportname": "http", + "id": "firewall", + "op": "GET", + "pri": "5", + "rcvd": "0", + "result": "403", + "sent": "256", + "srcportname": "ephemeral_fw_tcp" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 10:31:44", + "time": "2026-03-02 10:31:44" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "blocked.example.com", + "original": "/download.exe" + }, + "user": { + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T08:00:05.000+01:00", + "destination": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "domain": "remote_gateway", + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.50" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 08:00:05\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 08:00:03\" pri=5 phase=1 side=initiator ikev=2 remoteid=203.0.113.50 cookie_i=0x45718953174ba1b9 cookie_r=0x93b571aa2f43d0d1 src=203.0.113.1 srcname=Firewall_out dst=203.0.113.50 dstname=remote_gateway msg=\"Phase established\" logtype=\"vpn\"", + "start": "2026-03-02T08:00:03.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "message": "Phase established", + "network": { + "direction": "external" + }, + "observer": { + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "Firewall_out", + "remote_gateway" + ], + "ip": [ + "203.0.113.1", + "203.0.113.50" + ] + }, + "source": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.1" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "vpn", + "metadata": { + "cookie_i": "0x45718953174ba1b9", + "cookie_r": "0x93b571aa2f43d0d1", + "id": "firewall", + "ikev": "2", + "phase": "1", + "pri": "5", + "remoteid": "203.0.113.50", + "side": "initiator", + "srcname": "Firewall_out" + }, + "startime": "2026-03-02 08:00:03", + "time": "2026-03-02 08:00:05" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T08:00:06.000+01:00", + "destination": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "domain": "remote_gateway", + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.50" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 08:00:06\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 08:00:05\" pri=5 phase=2 side=responder ikev=2 spi_in=0x0c9f2ea1 spi_out=0x1a4b3c2d localnet=192.168.1.0/24 remotenet=192.168.2.0/24 src=203.0.113.1 srcname=Firewall_out dst=203.0.113.50 dstname=remote_gateway msg=\"Phase established\" logtype=\"vpn\"", + "start": "2026-03-02T08:00:05.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "message": "Phase established", + "network": { + "direction": "external" + }, + "observer": { + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "Firewall_out", + "remote_gateway" + ], + "ip": [ + "203.0.113.1", + "203.0.113.50" + ] + }, + "source": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.1" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "vpn", + "metadata": { + "id": "firewall", + "ikev": "2", + "localnet": "192.168.1.0/24", + "phase": "2", + "pri": "5", + "remotenet": "192.168.2.0/24", + "side": "responder", + "spi_in": "0x0c9f2ea1", + "spi_out": "0x1a4b3c2d", + "srcname": "Firewall_out" + }, + "startime": "2026-03-02 08:00:05", + "time": "2026-03-02 08:00:06" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T12:00:00.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "metric", + "original": "id=firewall time=\"2026-03-02 12:00:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 12:00:00\" Rule2:8=1612 Rule1:3=245781 logtype=\"count\"", + "start": "2026-03-02T12:00:00.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "observer": { + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "count", + "metadata": { + "id": "firewall", + "rule_stats": [ + { + "byte_count": 245781, + "category": "Global Filter Rule", + "original": "Rule1:3", + "rule_number": 3 + }, + { + "byte_count": 1612, + "category": "Local Filter Rule", + "original": "Rule2:8", + "rule_number": 8 + } + ] + }, + "startime": "2026-03-02 12:00:00", + "time": "2026-03-02 12:00:00" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T12:05:00.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "metric", + "original": "id=firewall time=\"2026-03-02 12:05:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 12:05:00\" Rule2:8=abc Rule9:12=77 Rule1:3:5=9 Rule0:2=512 logtype=\"count\"", + "start": "2026-03-02T12:05:00.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "observer": { + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "count", + "metadata": { + "id": "firewall", + "rule_stats": [ + { + "byte_count": 512, + "category": "Implicit Filter Rule", + "original": "Rule0:2", + "rule_number": 2 + } + ] + }, + "startime": "2026-03-02 12:05:00", + "time": "2026-03-02 12:05:00" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T09:45:22.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 0, + "kind": "event", + "original": "id=firewall time=\"2026-03-02 09:45:22\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 09:45:22\" user=\"jdoe\" domain=\"documentation\" error=0 src=203.0.113.77 srcname=remote_laptop msg=\"SSL VPN tunnel opened\" duration=0 totp=yes logtype=\"xvpn\"", + "start": "2026-03-02T09:45:22.000+01:00", + "timezone": "+01:00", + "type": [ + "connection" + ] + }, + "message": "SSL VPN tunnel opened", + "observer": { + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "remote_laptop" + ], + "ip": [ + "203.0.113.77" + ], + "user": [ + "jdoe" + ] + }, + "source": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.77" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "xvpn", + "metadata": { + "domain": "documentation", + "error": "0", + "id": "firewall", + "srcname": "remote_laptop", + "totp": "yes" + }, + "startime": "2026-03-02 09:45:22", + "time": "2026-03-02 09:45:22" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T14:20:10.000+01:00", + "destination": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.251", + "port": 5353 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 14:20:10\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 14:20:10\" pri=5 confid=00 slotlevel=2 ruleid=12 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=udp src=192.0.2.30 srcport=5353 dst=192.0.2.251 dstport=5353 dstportname=mdns ipv=4 action= logtype=\"filter\"", + "start": "2026-03-02T14:20:10.000+01:00", + "timezone": "+01:00", + "type": [ + "connection" + ] + }, + "network": { + "direction": "external", + "transport": "udp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.30", + "192.0.2.251" + ] + }, + "rule": { + "id": "12" + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.30", + "port": 5353 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "filter", + "metadata": { + "confid": "00", + "dstportname": "mdns", + "id": "firewall", + "pri": "5", + "slotlevel": "2" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 14:20:10", + "time": "2026-03-02 14:20:10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T15:00:00.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 15:00:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 15:00:00\" pri=5 msg=\"sample from a log family unknown to the categorization table\" logtype=\"futuretype\"", + "start": "2026-03-02T15:00:00.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "message": "sample from a log family unknown to the categorization table", + "observer": { + "name": "SN310A0000000001", + "type": "firewall", + "vendor": "Stormshield" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "futuretype", + "metadata": { + "id": "firewall", + "pri": "5" + }, + "startime": "2026-03-02 15:00:00", + "time": "2026-03-02 15:00:00" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml index 90c5f22565d..277e8f61f72 100644 --- a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml +++ b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml @@ -4,7 +4,7 @@ processors: - script: tag: script_process_devices lang: painless - description: Process device stat fields. + description: Process device stat fields, skipping counters that do not parse. params: devices: - Rule @@ -16,35 +16,53 @@ processors: - Global NAT Rule - Local NAT Rule source: >- - def ruleStats = [:]; + boolean isNumeric(def s) { + if (!(s instanceof String) || s.isEmpty() || s.length() > 18) { + return false; + } + for (int i = 0; i < s.length(); i++) { + if (Character.isDigit(s.charAt(i)) == false) { + return false; + } + } + return true; + } + def ruleStats = []; + def ruleKeys = []; def str = "Rule"; ctx.stormshield.forEach((k, v) -> { - if (k.startsWith(str)) { - def joined = k.substring(str.length()); - def parts = joined.splitByToken(":", 2); - ruleStats["original"] = k; - ruleStats["byte_count"] = v; - ruleStats["category"] = params.stats[Long.parseLong(parts[0])]; - ruleStats["rule_number"] = Long.parseLong(parts[1]); + if (k.startsWith(str) && k.indexOf(":") > str.length()) { + ruleKeys.add(k); + def parts = k.substring(str.length()).splitOnToken(":"); + if (parts.length == 2 && isNumeric(v) && isNumeric(parts[1]) && parts[0].length() == 1 && isNumeric(parts[0])) { + int category = Integer.parseInt(parts[0]); + if (category < params.stats.size()) { + def item = [:]; + item["original"] = k; + item["byte_count"] = Long.parseLong(v); + item["category"] = params.stats[category]; + item["rule_number"] = Long.parseLong(parts[1]); + ruleStats.add(item); + } + } } - + return true; }); + for (k in ruleKeys) { + ctx.stormshield.remove(k); + } + if (ruleStats.isEmpty()) { return; } - for (entry in ruleStats.entrySet()) { - ruleStats[entry.getKey()].sort((a, b) -> a["original"].compareTo(b["original"])); - } + ruleStats.sort((a, b) -> a["original"].compareTo(b["original"])); if (!ctx.stormshield.containsKey("metadata")) { ctx.stormshield.metadata = [:]; } ctx.stormshield.metadata.rule_stats = ruleStats; - for (entry in ruleStats.entrySet()) { - ctx.stormshield.remove(entry.getValue()["original"]); - } on_failure: - append: field: error.message diff --git a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml index b3dddc52f73..6b60f7d584d 100644 --- a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -139,6 +139,27 @@ processors: copy_from: stormshield.id if: ctx.stormshield?.id != null + - set: + tag: set_observer_ingress_interface_id + field: observer.ingress.interface.id + copy_from: stormshield.srcif + ignore_empty_value: true + - set: + tag: set_observer_ingress_interface_name + field: observer.ingress.interface.name + copy_from: stormshield.srcifname + ignore_empty_value: true + - set: + tag: set_observer_egress_interface_id + field: observer.egress.interface.id + copy_from: stormshield.dstif + ignore_empty_value: true + - set: + tag: set_observer_egress_interface_name + field: observer.egress.interface.name + copy_from: stormshield.dstifname + ignore_empty_value: true + - convert: tag: convert_stormshield_modsrc_to_source_nat_ip_cf7c07ec field: stormshield.modsrc @@ -222,7 +243,7 @@ processors: properties: - asn - organization_name - ignore_missing: true + if: ctx.destination?.ip != null - rename: tag: rename_destination_as_asn_to_destination_as_number_3b459fcd field: destination.as.asn @@ -246,7 +267,7 @@ processors: properties: - asn - organization_name - ignore_missing: true + if: ctx.source?.ip != null - rename: tag: rename_source_as_asn_to_source_as_number_a917047d field: source.as.asn @@ -295,6 +316,25 @@ processors: type: long ignore_missing: true + - convert: + tag: convert_stormshield_rcvd_to_destination_bytes + field: stormshield.rcvd + target_field: destination.bytes + type: long + ignore_missing: true + + - script: + tag: script_sum_network_bytes + lang: painless + description: Sum source and destination bytes into network.bytes. + if: ctx.source?.bytes != null && ctx.destination?.bytes != null + ignore_failure: true + source: >- + if (ctx.network == null) { + ctx.network = [:]; + } + ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes; + - rename: tag: rename_stormshield_dstname_to_destination_domain_675a68da field: stormshield.dstname @@ -446,6 +486,54 @@ processors: } + # Promote fields raised by the intrusion prevention engine before they are + # moved under stormshield.metadata. + - set: + tag: set_event_code_from_alarmid + field: event.code + copy_from: stormshield.alarmid + ignore_empty_value: true + - convert: + tag: convert_stormshield_risk_to_event_risk_score + field: stormshield.risk + target_field: event.risk_score + type: float + ignore_missing: true + on_failure: + - remove: + tag: remove_event_risk_score + field: event.risk_score + ignore_missing: true + # The pri field of alarm logs carries the alarm level (1 = major, 4 = minor), + # unlike other log families where it is a syslog-like severity hardcoded to 5. + - convert: + tag: convert_alarm_pri_to_event_severity + field: stormshield.pri + target_field: event.severity + type: long + if: ctx.stormshield?.logtype == 'alarm' && ctx.stormshield?.pri != null + ignore_failure: true + + # Promote HTTP proxy fields. + - set: + tag: set_url_original_from_arg + field: url.original + copy_from: stormshield.arg + ignore_empty_value: true + if: ctx.stormshield?.logtype == 'web' && ctx.stormshield?.arg != null + - set: + tag: set_url_domain_from_destination_domain + field: url.domain + copy_from: destination.domain + if: ctx.stormshield?.logtype == 'web' && ctx.destination?.domain != null + + - append: + tag: append_related_hosts_srcname + field: related.hosts + value: "{{{stormshield.srcname}}}" + if: ctx.stormshield?.srcname != null && ctx.stormshield.srcname != '' + allow_duplicates: false + - script: tag: script_move_things lang: painless @@ -463,30 +551,65 @@ processors: - authsslvpn - authtotp - authwebadmin + - cat_site - class + - classification + - clientappid - confid + - contentpolicy + - cookie_i + - cookie_r + - datechange + - domain - dstcontinent - dstcountry - dstportname - error + - filename + - filetype + - groupid + - icmpcode + - icmptype - id + - ikev + - localnet - mem + - method - modsrc - modsrcport - op + - phase - pri - rcvd + - remoteid + - remotenet + - repeat - result + - risk + - ruletype + - sandboxing + - sandboxinglevel - security + - sensible - sent + - serverappid - sessionid + - side - slotlevel - slotname + - spamlevel + - spi_in + - spi_out - srccontinent - srccountry - srcname - srcportname + - target + - totp + - urlruleid + - usergroup - version + - virus source: >- if (!ctx.stormshield.containsKey("metadata")) { ctx.stormshield.metadata = [:]; @@ -512,6 +635,86 @@ processors: type: long ignore_missing: true + # ------------------------------------------------------------ + # ECS categorization + - remove: + tag: remove_empty_event_action + description: An empty action field means the traffic matched a rule set to Log. + field: event.action + if: ctx.event?.action != null && ctx.event.action == '' + + - network_direction: + tag: network_direction + internal_networks: + - private + if: ctx.source?.ip != null && ctx.destination?.ip != null + ignore_failure: true + + - script: + tag: script_ecs_categorization + lang: painless + description: Set the ECS categorization fields from the log family and the rule action. + if: ctx.error == null + params: + logtypes: + alarm: { kind: alert, category: [intrusion_detection, network], type: [info] } + auth: { kind: event, category: [authentication], type: [start] } + authstat: { kind: metric, category: [authentication], type: [info] } + connection: { kind: event, category: [network, session], type: [connection, end] } + count: { kind: metric, category: [network], type: [info] } + date: { kind: event, category: [host], type: [change] } + dmrouting: { kind: event, category: [network, host], type: [change] } + filter: { kind: event, category: [network], type: [connection] } + filterstat: { kind: metric, category: [network], type: [info] } + ftp: { kind: event, category: [network], type: [info] } + ipsecstat: { kind: metric, category: [network], type: [info] } + monitor: { kind: metric, category: [host], type: [info] } + plugin: { kind: event, category: [network], type: [protocol] } + pop3: { kind: event, category: [email, network], type: [info] } + pvm: { kind: event, category: [vulnerability], type: [info] } + restapi: { kind: event, category: [web, configuration], type: [access] } + routerstat: { kind: metric, category: [network], type: [info] } + routing: { kind: event, category: [network, host], type: [change] } + sandboxing: { kind: event, category: [network], type: [info] } + server: { kind: event, category: [configuration], type: [access] } + smtp: { kind: event, category: [email, network], type: [info] } + ssl: { kind: event, category: [network], type: [connection] } + system: { kind: event, category: [host], type: [info] } + vpn: { kind: event, category: [network], type: [info] } + web: { kind: event, category: [web, network], type: [access] } + xvpn: { kind: event, category: [network, session], type: [connection] } + action_types: + pass: allowed + block: denied + action_logtypes: + - alarm + - connection + - filter + - ftp + - plugin + - pop3 + - smtp + - ssl + - web + source: >- + def logtype = ctx.stormshield?.logtype; + def entry = params.logtypes[logtype]; + if (entry == null) { + entry = ['kind': 'event', 'category': ['network'], 'type': ['info']]; + } + if (ctx.event == null) { + ctx.event = [:]; + } + ctx.event.kind = entry.kind; + ctx.event.category = new ArrayList(entry.category); + ctx.event.type = new ArrayList(entry.type); + if (params.action_logtypes.contains(logtype) && ctx.event.action instanceof String) { + def mapped = params.action_types[ctx.event.action.toLowerCase()]; + if (mapped != null && !ctx.event.type.contains(mapped)) { + ctx.event.type.add(mapped); + } + } + # ------------------------------------------------------------ # Add the 'related' fields - append: @@ -549,6 +752,13 @@ processors: if: ctx.user?.name != null allow_duplicates: false + - append: + tag: append_related_hosts_destination_domain + field: related.hosts + value: "{{{destination.domain}}}" + if: ctx.destination?.domain != null + allow_duplicates: false + # ------------------------------------------------------------ # Cleanup - remove: diff --git a/packages/stormshield/data_stream/log/fields/ecs.yml b/packages/stormshield/data_stream/log/fields/ecs.yml index f979a751479..69fe5a28969 100644 --- a/packages/stormshield/data_stream/log/fields/ecs.yml +++ b/packages/stormshield/data_stream/log/fields/ecs.yml @@ -104,11 +104,45 @@ name: rule.name - external: ecs name: source.bytes +- external: ecs + name: destination.bytes +- external: ecs + name: network.bytes +- external: ecs + name: network.direction +- external: ecs + name: observer.ingress.interface.id +- external: ecs + name: observer.ingress.interface.name +- external: ecs + name: observer.egress.interface.id +- external: ecs + name: observer.egress.interface.name +- external: ecs + name: event.action - external: ecs name: event.duration +- external: ecs + name: event.kind +- external: ecs + name: event.category +- external: ecs + name: event.type +- external: ecs + name: event.code +- external: ecs + name: event.risk_score +- external: ecs + name: event.severity +- external: ecs + name: url.original +- external: ecs + name: url.domain - external: ecs name: related.ip - external: ecs name: related.user +- external: ecs + name: related.hosts - external: ecs name: user.name diff --git a/packages/stormshield/data_stream/log/sample_event.json b/packages/stormshield/data_stream/log/sample_event.json index f368f0770ea..d0f9951be78 100644 --- a/packages/stormshield/data_stream/log/sample_event.json +++ b/packages/stormshield/data_stream/log/sample_event.json @@ -1,39 +1,46 @@ { "@timestamp": "2024-03-08T10:14:08.000Z", "agent": { - "ephemeral_id": "fbc0ca2c-7300-45ce-84b1-6ece2bc46905", - "id": "e0b60804-99ad-435e-865c-35384901d186", - "name": "elastic-agent-45518", + "ephemeral_id": "19c5155e-5f61-4dc1-b23c-cd84e946b455", + "id": "63ff8a64-ec88-4856-ba1c-8653054b4358", + "name": "elastic-agent-17632", "type": "filebeat", - "version": "8.14.1" + "version": "9.4.3" }, "data_stream": { "dataset": "stormshield.log", - "namespace": "65295", + "namespace": "52256", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "e0b60804-99ad-435e-865c-35384901d186", + "id": "63ff8a64-ec88-4856-ba1c-8653054b4358", "snapshot": false, - "version": "8.14.1" + "version": "9.4.3" }, "event": { "agent_id_status": "verified", + "category": [ + "configuration" + ], "dataset": "stormshield.log", - "ingested": "2024-09-18T14:01:36Z", + "ingested": "2026-07-08T10:05:22Z", + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"PKI SEARCH scope=local type=ca\" logtype=\"server\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "input": { "type": "tcp" }, "log": { "source": { - "address": "172.27.0.3:40024" + "address": "172.21.0.3:49430" }, "syslog": { "appname": "serverd", @@ -80,4 +87,4 @@ "user": { "name": "admin" } -} \ No newline at end of file +} diff --git a/packages/stormshield/docs/README.md b/packages/stormshield/docs/README.md index f56d3892238..83307e07d3c 100644 --- a/packages/stormshield/docs/README.md +++ b/packages/stormshield/docs/README.md @@ -270,6 +270,40 @@ To collect logs via UDP, select **Collect logs via UDP** and configure the follo You'll find events from Stormshield SNS logs in the `log` data stream. This data stream includes logs of the following types: traffic, filter, protection, and system events. +##### ECS event categorization + +Each log family (identified by the `logtype` field) is mapped to the ECS categorization fields. Alarms raised by the intrusion prevention engine produce `event.kind: alert`. The periodic statistics families (`monitor`, `filterstat`, `count`, `routerstat`, `authstat`, `ipsecstat`) produce `event.kind: metric`, so health telemetry can be excluded from detection rule scopes with a single filter. All other families produce `event.kind: event`. + +| logtype | event.kind | event.category | event.type | +|---|---|---|---| +| alarm | alert | intrusion_detection, network | info | +| auth | event | authentication | start | +| authstat | metric | authentication | info | +| connection | event | network, session | connection, end | +| count, filterstat, ipsecstat, routerstat | metric | network | info | +| date | event | host | change | +| dmrouting, routing | event | network, host | change | +| filter | event | network | connection | +| ftp | event | network | info | +| monitor | metric | host | info | +| plugin | event | network | protocol | +| pop3, smtp | event | email, network | info | +| pvm | event | vulnerability | info | +| restapi | event | web, configuration | access | +| sandboxing | event | network | info | +| server | event | configuration | access | +| ssl | event | network | connection | +| system | event | host | info | +| vpn | event | network | info | +| web | event | web, network | access | +| xvpn | event | network, session | connection | + +For the families that carry a rule action, `event.type` additionally receives `allowed` when the action is `pass` and `denied` when the action is `block` (matched case-insensitively). An empty action field corresponds to a rule set to Log, and no modifier is added. Unknown log families fall back to `event.kind: event` with `event.category: network` and `event.type: info`. + +For alarm logs, `event.code` carries the Stormshield alarm identifier, `event.risk_score` the `risk` field (1-100), and `event.severity` the vendor alarm level from `pri`, where 1 is a major alarm and 4 a minor alarm. This scale is specific to the alarm family. In most other families, the appliance hardcodes the `pri` field to 5. + +`network.direction` is computed from the source and destination IP addresses, treating private (RFC 1918) address ranges as internal networks. + ##### `log` fields You'll find a list of all exported fields in the following table: @@ -285,6 +319,7 @@ You'll find a list of all exported fields in the following table: | destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | destination.as.organization.name | Organization name. | keyword | | destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.bytes | Bytes sent from the destination to the source. | long | | destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | destination.geo.city_name | City name. | keyword | | destination.geo.continent_name | Name of the continent. | keyword | @@ -300,7 +335,14 @@ You'll find a list of all exported fields in the following table: | destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | +| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | input.type | Type of input. | keyword | | log.source.address | Source address for the log. | keyword | | log.syslog.appname | The device or application that originated the Syslog message, if available. | keyword | @@ -312,15 +354,22 @@ You'll find a list of all exported fields in the following table: | log.syslog.severity.name | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`. | keyword | | log.syslog.version | The version of the Syslog protocol specification. Only applicable for RFC 5424 messages. | keyword | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | | network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | | network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | | network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | +| observer.egress.interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | +| observer.egress.interface.name | Interface name as reported by the system. | keyword | +| observer.ingress.interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | +| observer.ingress.interface.name | Interface name as reported by the system. | keyword | | observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | | observer.product | The product name of the observer. | keyword | | observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | | observer.vendor | Vendor name of the observer. | keyword | | process.name | Process name. Sometimes called program name or similar. | keyword | | process.name.text | Multi-field of `process.name`. | match_only_text | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | | rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | @@ -357,6 +406,9 @@ You'll find a list of all exported fields in the following table: | stormshield.system | Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, and so on). Decimal format representing a percentage. | keyword | | stormshield.time | Local time at which the log was recorded in the log file (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0. | keyword | | tags | List of keywords used to tag each event. | keyword | +| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | | user.name | Short name or login of the user. | keyword | | user.name.text | Multi-field of `user.name`. | match_only_text | @@ -371,39 +423,46 @@ An example event for `log` looks as following: { "@timestamp": "2024-03-08T10:14:08.000Z", "agent": { - "ephemeral_id": "fbc0ca2c-7300-45ce-84b1-6ece2bc46905", - "id": "e0b60804-99ad-435e-865c-35384901d186", - "name": "elastic-agent-45518", + "ephemeral_id": "19c5155e-5f61-4dc1-b23c-cd84e946b455", + "id": "63ff8a64-ec88-4856-ba1c-8653054b4358", + "name": "elastic-agent-17632", "type": "filebeat", - "version": "8.14.1" + "version": "9.4.3" }, "data_stream": { "dataset": "stormshield.log", - "namespace": "65295", + "namespace": "52256", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "e0b60804-99ad-435e-865c-35384901d186", + "id": "63ff8a64-ec88-4856-ba1c-8653054b4358", "snapshot": false, - "version": "8.14.1" + "version": "9.4.3" }, "event": { "agent_id_status": "verified", + "category": [ + "configuration" + ], "dataset": "stormshield.log", - "ingested": "2024-09-18T14:01:36Z", + "ingested": "2026-07-08T10:05:22Z", + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"PKI SEARCH scope=local type=ca\" logtype=\"server\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "input": { "type": "tcp" }, "log": { "source": { - "address": "172.27.0.3:40024" + "address": "172.21.0.3:49430" }, "syslog": { "appname": "serverd", diff --git a/packages/stormshield/kibana/dashboard/stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002.json b/packages/stormshield/kibana/dashboard/stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002.json new file mode 100644 index 00000000000..d66d7407525 --- /dev/null +++ b/packages/stormshield/kibana/dashboard/stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002.json @@ -0,0 +1,1060 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"440785c6-61cc-4a85-a129-e4aa5f32590f\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"440785c6-61cc-4a85-a129-e4aa5f32590f\",\"fieldName\":\"stormshield.fw\",\"title\":\"Firewall Id\",\"grow\":false,\"width\":\"small\",\"enhancements\":{}}},\"0e8afad9-83ae-43ac-8f0e-aac581300173\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0e8afad9-83ae-43ac-8f0e-aac581300173\",\"fieldName\":\"event.action\",\"title\":\"event.action\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{},\"selectedOptions\":[]}},\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\",\"fieldName\":\"log.syslog.facility.name\",\"title\":\"Syslog facility\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"fa254ad2-d372-4df0-91f1-e277f993a09d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fa254ad2-d372-4df0-91f1-e277f993a09d\",\"fieldName\":\"log.syslog.severity.name\",\"title\":\"Syslog severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\",\"fieldName\":\"user.name\",\"title\":\"User\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}}}" + }, + "description": "Alarms raised by the intrusion prevention engine of Stormshield SNS firewalls.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "stormshield.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "stormshield.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "stormshield.logtype", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "stormshield.logtype", + "negate": false, + "params": { + "query": "alarm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "stormshield.logtype": "alarm" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-33a48b60-d148-58ee-923b-3159d9f3d942", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "33a48b60-d148-58ee-923b-3159d9f3d942": { + "columnOrder": [ + "f7210768-ca8b-5361-9a22-2db31997589d", + "fa27ea62-35f0-5454-893c-93bf97353d4a" + ], + "columns": { + "f7210768-ca8b-5361-9a22-2db31997589d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "fa27ea62-35f0-5454-893c-93bf97353d4a": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "fa27ea62-35f0-5454-893c-93bf97353d4a" + ], + "layerId": "33a48b60-d148-58ee-923b-3159d9f3d942", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "f7210768-ca8b-5361-9a22-2db31997589d" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "dbd36ee2-ce51-5c01-a7f8-20ac061ff0ed", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "dbd36ee2-ce51-5c01-a7f8-20ac061ff0ed", + "title": "Alarms over time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0dc1a2d0-031c-54cc-bb3d-511946e4dc07", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0dc1a2d0-031c-54cc-bb3d-511946e4dc07": { + "columnOrder": [ + "5f4b706b-b9e3-5fc7-b64c-c6a24dcb1073" + ], + "columns": { + "5f4b706b-b9e3-5fc7-b64c-c6a24dcb1073": { + "dataType": "number", + "isBucketed": false, + "label": "Alarms", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___", + "customLabel": true + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "0dc1a2d0-031c-54cc-bb3d-511946e4dc07", + "layerType": "data", + "metricAccessor": "5f4b706b-b9e3-5fc7-b64c-c6a24dcb1073" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} + }, + "gridData": { + "h": 9, + "i": "6b282572-fec2-5663-b8f6-5574cf407f28", + "w": 8, + "x": 24, + "y": 0 + }, + "panelIndex": "6b282572-fec2-5663-b8f6-5574cf407f28", + "type": "lens", + "title": "Alarm count" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ab83a13d-87c9-5f49-a26d-c237bc57dc4d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "ab83a13d-87c9-5f49-a26d-c237bc57dc4d": { + "columnOrder": [ + "8ea7fbe1-bf06-5ded-93ad-75477f36a6d1", + "ce655896-0b85-5fee-905a-fc799f08fc01" + ], + "columns": { + "ce655896-0b85-5fee-905a-fc799f08fc01": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8ea7fbe1-bf06-5ded-93ad-75477f36a6d1": { + "dataType": "number", + "isBucketed": true, + "label": "Top 4 values of event.severity", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ce655896-0b85-5fee-905a-fc799f08fc01", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 4 + }, + "scale": "ordinal", + "sourceField": "event.severity" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "ab83a13d-87c9-5f49-a26d-c237bc57dc4d", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "ce655896-0b85-5fee-905a-fc799f08fc01" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8ea7fbe1-bf06-5ded-93ad-75477f36a6d1" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "b9ba912b-0fda-5235-b94e-c8ea532091e3", + "w": 16, + "x": 32, + "y": 0 + }, + "panelIndex": "b9ba912b-0fda-5235-b94e-c8ea532091e3", + "title": "Alarm severity (1 = major, 4 = minor)", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b76aee0c-46c5-556f-8ba8-4b99965cf0f2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "b76aee0c-46c5-556f-8ba8-4b99965cf0f2": { + "columnOrder": [ + "8f39f632-def2-5159-98ec-ef7807dc1a32", + "b6c55eb3-6e0f-5056-8c16-c9200e6523f4" + ], + "columns": { + "b6c55eb3-6e0f-5056-8c16-c9200e6523f4": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8f39f632-def2-5159-98ec-ef7807dc1a32": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of event.action", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b6c55eb3-6e0f-5056-8c16-c9200e6523f4", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "b76aee0c-46c5-556f-8ba8-4b99965cf0f2", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "b6c55eb3-6e0f-5056-8c16-c9200e6523f4" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8f39f632-def2-5159-98ec-ef7807dc1a32" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "5daca082-ec6c-5528-ba45-b16eed39c5d5", + "w": 12, + "x": 0, + "y": 9 + }, + "panelIndex": "5daca082-ec6c-5528-ba45-b16eed39c5d5", + "title": "Alarm actions", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fb51d00c-6e2a-514f-a775-3e64e2c37195", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "fb51d00c-6e2a-514f-a775-3e64e2c37195": { + "columnOrder": [ + "f4c67c7f-b5e7-5f96-9909-df2990164ac8", + "2a5948c7-c27b-5fb5-af9b-fe9469a0e572" + ], + "columns": { + "2a5948c7-c27b-5fb5-af9b-fe9469a0e572": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f4c67c7f-b5e7-5f96-9909-df2990164ac8": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of event.code", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2a5948c7-c27b-5fb5-af9b-fe9469a0e572", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.code" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "fb51d00c-6e2a-514f-a775-3e64e2c37195", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "2a5948c7-c27b-5fb5-af9b-fe9469a0e572" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "f4c67c7f-b5e7-5f96-9909-df2990164ac8" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "334053ec-d73a-51e1-9cd1-481487b181b5", + "w": 12, + "x": 12, + "y": 9 + }, + "panelIndex": "334053ec-d73a-51e1-9cd1-481487b181b5", + "title": "Top alarm IDs", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-181889fe-90e3-5c30-b75f-f0411a0ac138", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "181889fe-90e3-5c30-b75f-f0411a0ac138": { + "columnOrder": [ + "8860558d-c7b7-5cc6-9bc4-b0cf3012022f", + "f138ffd2-631c-5ba3-ab35-a276613937ca" + ], + "columns": { + "f138ffd2-631c-5ba3-ab35-a276613937ca": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8860558d-c7b7-5cc6-9bc4-b0cf3012022f": { + "dataType": "ip", + "isBucketed": true, + "label": "Top 10 values of source.ip", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f138ffd2-631c-5ba3-ab35-a276613937ca", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "181889fe-90e3-5c30-b75f-f0411a0ac138", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "f138ffd2-631c-5ba3-ab35-a276613937ca" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8860558d-c7b7-5cc6-9bc4-b0cf3012022f" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "d0bffc64-50b7-5de6-8f0f-ed50cda30796", + "w": 12, + "x": 24, + "y": 9 + }, + "panelIndex": "d0bffc64-50b7-5de6-8f0f-ed50cda30796", + "title": "Top source addresses", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cb829b24-4bc5-5934-bdd4-38b00af9d1e1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "cb829b24-4bc5-5934-bdd4-38b00af9d1e1": { + "columnOrder": [ + "7e9246e0-4f9f-5ae7-b735-90a23f9b057e", + "78b1b4ce-310d-5476-990e-14fa234e48d6" + ], + "columns": { + "78b1b4ce-310d-5476-990e-14fa234e48d6": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7e9246e0-4f9f-5ae7-b735-90a23f9b057e": { + "dataType": "number", + "isBucketed": true, + "label": "Top 10 values of destination.port", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "78b1b4ce-310d-5476-990e-14fa234e48d6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.port" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "cb829b24-4bc5-5934-bdd4-38b00af9d1e1", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "78b1b4ce-310d-5476-990e-14fa234e48d6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7e9246e0-4f9f-5ae7-b735-90a23f9b057e" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "82efd6ff-47ab-5957-92b3-ff013ad6fd2d", + "w": 12, + "x": 36, + "y": 9 + }, + "panelIndex": "82efd6ff-47ab-5957-92b3-ff013ad6fd2d", + "title": "Top destination ports", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7fb571c8-8876-58ec-a1ae-00c5da9c1bec", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "7fb571c8-8876-58ec-a1ae-00c5da9c1bec": { + "columnOrder": [ + "31f833eb-ecf9-58a7-a956-51e819453761", + "6a581dde-0878-5fbf-bf99-81dbdd5328d9" + ], + "columns": { + "6a581dde-0878-5fbf-bf99-81dbdd5328d9": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "31f833eb-ecf9-58a7-a956-51e819453761": { + "dataType": "string", + "isBucketed": true, + "label": "Top 12 values of observer.name", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6a581dde-0878-5fbf-bf99-81dbdd5328d9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 12 + }, + "scale": "ordinal", + "sourceField": "observer.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "7fb571c8-8876-58ec-a1ae-00c5da9c1bec", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "6a581dde-0878-5fbf-bf99-81dbdd5328d9" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "31f833eb-ecf9-58a7-a956-51e819453761" + ] + } + ], + "shape": "treemap" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "ac219908-ca85-5b5a-88f9-1f96a77ce979", + "w": 48, + "x": 0, + "y": 18 + }, + "panelIndex": "ac219908-ca85-5b5a-88f9-1f96a77ce979", + "title": "Alarms by firewall", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Stormshield] Alarms (IPS)", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "id": "stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dbd36ee2-ce51-5c01-a7f8-20ac061ff0ed:indexpattern-datasource-layer-33a48b60-d148-58ee-923b-3159d9f3d942", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6b282572-fec2-5663-b8f6-5574cf407f28:indexpattern-datasource-layer-0dc1a2d0-031c-54cc-bb3d-511946e4dc07", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b9ba912b-0fda-5235-b94e-c8ea532091e3:indexpattern-datasource-layer-ab83a13d-87c9-5f49-a26d-c237bc57dc4d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5daca082-ec6c-5528-ba45-b16eed39c5d5:indexpattern-datasource-layer-b76aee0c-46c5-556f-8ba8-4b99965cf0f2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "334053ec-d73a-51e1-9cd1-481487b181b5:indexpattern-datasource-layer-fb51d00c-6e2a-514f-a775-3e64e2c37195", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d0bffc64-50b7-5de6-8f0f-ed50cda30796:indexpattern-datasource-layer-181889fe-90e3-5c30-b75f-f0411a0ac138", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "82efd6ff-47ab-5957-92b3-ff013ad6fd2d:indexpattern-datasource-layer-cb829b24-4bc5-5934-bdd4-38b00af9d1e1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ac219908-ca85-5b5a-88f9-1f96a77ce979:indexpattern-datasource-layer-7fb571c8-8876-58ec-a1ae-00c5da9c1bec", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "8.9.0" +} diff --git a/packages/stormshield/manifest.yml b/packages/stormshield/manifest.yml index 126f4aeff80..ec04fa73705 100644 --- a/packages/stormshield/manifest.yml +++ b/packages/stormshield/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.1.1 name: stormshield title: "StormShield SNS" -version: "1.5.3" +version: "1.6.0" source: license: "Elastic-2.0" description: "Stormshield SNS integration."