diff --git a/packages/stormshield/_dev/build/docs/README.md b/packages/stormshield/_dev/build/docs/README.md index 61b52da5fb6..ad8a316f1d0 100644 --- a/packages/stormshield/_dev/build/docs/README.md +++ b/packages/stormshield/_dev/build/docs/README.md @@ -9,7 +9,7 @@ The StormShield SNS integration for Elastic enables you to collect and analyze s This integration is compatible with the following third-party vendor systems: - Stormshield Network Security (SNS) firewalls running the unified firmware base. -- SNS v4.x, which is the primarily documented and tested version for these log formats. +- SNS 4.x and SNS 5.x, which share the same WELF key-value audit log format. ### How it works @@ -17,7 +17,7 @@ This integration collects logs from Stormshield SNS firewalls by receiving syslo ## What data does this integration collect? -The StormShield SNS integration collects a variety of security and system events from SNS instances. Each data stream provides specific insights into network activity: +The StormShield SNS integration collects a variety of security and system events from SNS instances into a single `log` data stream. The collected log families provide specific insights into network activity: - Firewall logs: These provide detailed records of filter and NAT policy decisions, including source and destination IP addresses, ports, and protocols. - Audit and administrative logs: These capture events related to administrative logins, configuration changes through `serverd`, and system-level operations. - Alarm logs: These contain security-specific alerts generated by the SNS Intrusion Prevention System (IPS) and detection engines. @@ -68,36 +68,40 @@ To configure Stormshield Network Security (SNS) to forward logs to the Elastic A 1. Log in to the Stormshield Network Security web administration interface. 2. Navigate to the **CONFIGURATION** tab. -3. Go to **NOTIFICATIONS > LOGS - SYSLOG - IPFIX**. +3. Go to **NOTIFICATIONS → LOGS - SYSLOG - IPFIX**. 4. In the **Syslog** section, make sure the service is enabled by switching the status to **ON**. 5. Select a **Profile** slot to edit (e.g., Profile 1). 6. In the **Syslog server** field, select or create a host object corresponding to the Elastic Agent host. 7. Enter the **Port** number matching your Elastic Agent configuration (e.g., `514` for UDP or `601` for TCP). 8. Select the **Protocol** (**UDP** or **TCP**) that matches your integration input. -9. Choose the **Format**: **RFC5424** is recommended for modern logging, though **Legacy** (BSD) is also supported. +9. Set the **Format** to **RFC5424**. The integration expects RFC5424 messages; the **Legacy** and **Legacy long** formats are not supported at this time. 10. In the **Advanced properties** section, enable the specific log families you want to send. Make sure **Filter Policy**, **Administration**, **System**, and **Alarms** are active. 11. Click **Apply** to save the syslog configuration. #### Enabling traffic logs for specific rules -1. Navigate to **Configuration > Security policy > Filter - NAT**. +1. Navigate to **Configuration → Security policy → Filter - NAT**. 2. Identify the security rules for which you want to collect logs. 3. Double-click a rule to open its properties. 4. Go to the **Action** menu or the General tab. 5. Set the **Log level** to **Standard (connection log)**. 6. Click **OK** and then click **Apply** at the top of the interface to deploy the policy change. +#### Collecting flow records over IPFIX (optional) + +SNS firewalls can also export network flow records over the IPFIX protocol, configured in the same **NOTIFICATIONS → LOGS - SYSLOG - IPFIX** module (default port `4739`). Flow records are not handled by this integration: to collect them, use the [NetFlow Records](https://www.elastic.co/docs/reference/integrations/netflow) integration, which supports IPFIX. Both integrations can run on the same Elastic Agent to combine audit logs with flow analytics. + #### Vendor resources -- [Stormshield SNS Syslog Configuration](https://documentation.stormshield.eu/SNS/v4/en/Content/User_Configuration_Manual_SNS_v4/Logs-syslog/Syslog_tab.htm) -- [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm) +- [Stormshield SNS Syslog Configuration](https://documentation.stormshield.eu/SNS/v5/en/Content/User_Configuration_Manual_SNS_v5/Logs-syslog/Syslog_tab.htm) +- [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v5/en/Content/Description_of_Audit_logs/Configure_logs.htm) - [FireMon - Stormshield Device Configuration Guide](https://docs.firemon.com/feature/Content/ADMINISTRATION/DEVICE/Devices/StormShield/Stormshield_Network_Security.htm?TocPath=Administration|Device|Devices|Choose+a+Device+to+Onboard|_____51) ### Set up steps in Kibana To set up the integration in Kibana, follow these steps: -1. In Kibana, navigate to **Management > Integrations**. +1. In Kibana, navigate to **Management → Integrations**. 2. Search for and select **Stormshield SNS**. 3. Click **Add Stormshield SNS**. 4. Configure the inputs based on your Stormshield SNS configuration. @@ -159,11 +163,11 @@ Perform the following actions on your Stormshield device to generate logs: #### 2. Check data in Kibana To verify the data in Kibana: -1. Navigate to **Analytics > Discover**. +1. Navigate to **Analytics → Discover**. 2. Select the `logs-*` data view. 3. Enter the following KQL filter in the search bar: `data_stream.dataset : "stormshield.log"` 4. Verify logs appear and expand an entry to confirm the presence of fields like `event.dataset`, `source.ip`, and `message`. -5. Navigate to **Analytics > Dashboards** and search for "Stormshield SNS" to view pre-built visualizations. +5. Navigate to **Analytics → Dashboards** and search for "Stormshield SNS" to view pre-built visualizations. ## Troubleshooting @@ -203,6 +207,42 @@ For more information on architectures that can be used for scaling this integrat You'll find events from Stormshield SNS logs in the `log` data stream. This data stream includes logs of the following types: traffic, filter, protection, and system events. +##### ECS event categorization + +Each log family (identified by the `logtype` field) is mapped to the ECS categorization fields. Alarms raised by the intrusion prevention engine produce `event.kind: alert`. The periodic statistics families (`monitor`, `filterstat`, `count`, `routerstat`, `authstat`, `ipsecstat`) produce `event.kind: metric`, so health telemetry can be excluded from detection rule scopes with a single filter. All other families produce `event.kind: event`. + +| logtype | event.kind | event.category | event.type | +|---|---|---|---| +| alarm | alert | intrusion_detection, network | info | +| auth | event | authentication | start | +| authstat | metric | authentication | info | +| connection | event | network, session | connection, end | +| count, filterstat, ipsecstat, routerstat | metric | network | info | +| date | event | host | change | +| dmrouting, routing | event | network, host | change | +| filter | event | network | connection | +| ftp | event | network | info | +| monitor | metric | host | info | +| plugin | event | network | protocol | +| pop3, smtp | event | email, network | info | +| pvm | event | vulnerability | info | +| restapi | event | web, configuration | access | +| sandboxing | event | network | info | +| server | event | configuration | access | +| ssl | event | network | connection | +| system | event | host | info | +| vpn | event | network | info | +| web | event | web, network | access | +| xvpn | event | network, session | connection | + +For the families that carry a rule action, `event.type` additionally receives `allowed` when the action is `pass` and `denied` when the action is `block` (matched case-insensitively). An empty action field corresponds to a rule set to Log, and no modifier is added. Unknown log families fall back to `event.kind: event` with `event.category: network` and `event.type: info`. + +For the `auth`, `server` and `xvpn` families, `event.outcome` is derived from the vendor `error` field: `success` when the error code is `0`, `failure` otherwise. + +For alarm logs, `event.code` carries the Stormshield alarm identifier, `event.risk_score` the `risk` field (1-100), and `event.severity` the vendor alarm level from `pri`, where 1 is a major alarm and 4 a minor alarm. This scale is specific to the alarm family. In most other families, the appliance hardcodes the `pri` field to 5. + +`network.direction` is computed from the source and destination IP addresses, treating private (RFC 1918) address ranges as internal networks. + ##### `log` fields You'll find a list of all exported fields in the following table: @@ -218,5 +258,5 @@ The following is a sample event for the `log` data stream: ### Vendor documentation links You'll find additional details about Stormshield SNS logs in these official resources: -* [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm) +* [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v5/en/Content/Description_of_Audit_logs/Configure_logs.htm) * [Stormshield Official Website](https://www.stormshield.com) diff --git a/packages/stormshield/changelog.yml b/packages/stormshield/changelog.yml index 832fc1c78c3..4dda3c0d087 100644 --- a/packages/stormshield/changelog.yml +++ b/packages/stormshield/changelog.yml @@ -1,4 +1,48 @@ # newer versions go on top +- version: "1.8.0" + changes: + - description: Add Network Traffic, Web Activity and Users & VPN dashboards, link every dashboard from the Overview, and extend the Overview with an appliance health row covering the periodic statistics families. + type: enhancement + link: https://github.com/elastic/integrations/pull/20088 + - description: Rename the dashboards to the "[Stormshield SNS]" title prefix to make room for other Stormshield product integrations. + type: enhancement + link: https://github.com/elastic/integrations/pull/20088 + - description: Fix the dashboard controls, which referenced no data view and were dropped by Kibana at render time, title the event count panel of the Overview dashboard, and replace the terms aggregation on `event.duration` with a median over time. + type: bugfix + link: https://github.com/elastic/integrations/pull/20088 +- version: "1.7.0" + changes: + - description: Set `event.outcome` on authentication, server and SSL VPN logs from the vendor error code, map `domain` and `usergroup` to `user.domain` and `user.group.name`, the HTTP method and return code of web logs to `http.request.method` and `http.response.status_code`, the system daemon name to `process.name`, and set `observer.product`. + type: enhancement + link: https://github.com/elastic/integrations/pull/20085 + - description: Preserve the reputation, packet-capture, Ethernet protocol, SSO agent, IKE peer and industrial-protocol vendor fields under `stormshield.metadata` instead of leaving them as undeclared fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/20085 +- version: "1.6.0" + changes: + - description: Set ECS event categorization fields (`event.kind`, `event.category`, `event.type`) for every log family, including `event.kind` `metric` for the periodic statistics families. + type: enhancement + link: https://github.com/elastic/integrations/pull/20031 + - description: Map `rcvd` to `destination.bytes`, sum `network.bytes`, map interface fields to `observer.ingress` and `observer.egress`, compute `network.direction`, and populate `related.hosts`. + type: enhancement + link: https://github.com/elastic/integrations/pull/20031 + - description: Map alarm identifiers and levels to `event.code`, `event.risk_score` and `event.severity`, and HTTP proxy fields to `url.original` and `url.domain`. + type: enhancement + link: https://github.com/elastic/integrations/pull/20031 + - description: Fix the count sub-pipeline, which failed with a Painless runtime error on every count log, and skip malformed counters instead of failing the whole document. + type: bugfix + link: https://github.com/elastic/integrations/pull/20031 + - description: Add an Alarms dashboard and pipeline test samples for the alarm, auth, web, vpn, xvpn, count and filter log families. + type: enhancement + link: https://github.com/elastic/integrations/pull/20031 +- version: "1.5.3" + changes: + - description: Fix ingest pipeline descriptions and remove field definitions that never appear in events (`stormshield.tz`, `stormshield.duration`, `stormshield.msg`, `stormshield.origdst`, `stormshield.origdstport`). + type: bugfix + link: https://github.com/elastic/integrations/pull/20030 + - description: Correct the syslog format and SNS version compatibility statements in the documentation, and document IPFIX flow collection through the NetFlow integration. + type: bugfix + link: https://github.com/elastic/integrations/pull/20030 - version: "1.5.2" changes: - description: Remove top level note from docs diff --git a/packages/stormshield/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json index 3baa9b1deaa..5a262b2cbe3 100644 --- a/packages/stormshield/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json +++ b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json @@ -6,12 +6,20 @@ "version": "8.17.0" }, "event": { + "category": [ + "network" + ], + "kind": "metric", "original": "id=firewall time=\"2024-03-08 17:29:51\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 17:29:51\" SavedEvaluation=621 DynamicMem=0 HostMem=0 FragMem=0 ICMPMem=0 ConnMem=0 AssocMem=0 EtherStateMem=0 IPStateMem=0 DTrackMem=0 Logged=11 LogOverflow=0 HostrepMax=0 HostrepScore=0 HostrepRequests=0 PvmFacts=0 PvmOverflow=0 Accepted=105 Blocked=0 Byte(i/o)=10592/14285 Fragmented=0 TCPPacket=0 TCPByte(i/o)=0/0 TCPConn=0 TCPConnNatSrc=0 TCPConnNatDst=0 TCPConnNoNatSrc=0 TCPConnNoNatDst=0 UDPPacket=104 UDPByte(i/o)=10283/14285 UDPConn=0 UDPConnNatSrc=0 UDPConnNatDst=0 UDPConnNoNatSrc=0 UDPConnNoNatDst=0 ICMPPacket=1 ICMPByte(i/o)=309/0 IPStatePacket=0 IPStateByte(i/o)=0/0 IPStateConn=0 IPStateConnNatSrc=0 IPStateConnNatDst=0 IPStateConnNoNatSrc=0 IPStateConnNoNatDst=0 SCTPAssocPacket=0 SCTPAssocByte(i/o)=0/0 SCTPAssoc=0 EtherStatePacket=0 EtherStateByte(i/o)=0/0 EtherStateConn=0 TLSCertCacheEntriesNb=0 TLSCertCacheLookup(miss/total)=0/0 TLSCertCacheInsert=0 TLSCertCacheFlushOp=0 TLSCertCachePurgeOp=0 TLSCertCacheFlushedNb=0 TLSCertCachePurgedNb=0 TLSCertCacheExpiredNb=0 logtype=\"filterstat\"", "start": "2024-03-08T17:29:51.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -121,6 +129,7 @@ "name": "Bredband2 AB" } }, + "bytes": 48, "domain": "ntp2.stormshieldcs.eu", "geo": { "city_name": "Linköping", @@ -146,22 +155,45 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 90000000, + "kind": "event", "original": "id=firewall time=\"2024-03-08 17:29:30\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 12:27:28\" pri=5 confid=01 slotlevel=0 ruleid=7 ipproto=udp dstif=\"Ethernet0\" dstifname=\"out\" proto=ntp src=192.168.197.134 srcport=123 srcportname=ntp srcname=Firewall_out dst=1.128.0.1 dstport=123 dstportname=ntp dstname=ntp2.stormshieldcs.eu dstcontinent=\"eu\" dstcountry=\"fr\" modsrc=192.168.197.134 modsrcport=123 origdst=89.160.20.182 origdstport=123 ipv=4 sent=48 rcvd=48 duration=0.09 action=pass logtype=\"connection\"", "start": "2024-03-08T12:27:28.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 96, + "direction": "outbound", "protocol": "ntp", "transport": "udp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out", + "ntp2.stormshieldcs.eu" + ], "ip": [ "192.168.197.134", "89.160.20.182", @@ -207,12 +239,20 @@ "version": "8.17.0" }, "event": { + "category": [ + "authentication" + ], + "kind": "metric", "original": "id=firewall time=\"2024-03-08 17:30:58\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 17:30:58\" auth=0 authtotp=0 authcaptive=0 authwebadmin=0 authsslvpn=0 authipsec=0 authconsole=0 logtype=\"authstat\"", "start": "2024-03-08T17:30:58.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -242,12 +282,20 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "metric", "original": "id=firewall time=\"2024-03-08 17:31:09\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 17:31:09\" security=0 system=0 CPU=1,1,1 Pvm=0,0,0,0,0,0,0,0,0,0,0 sslvpn1=sslvpn_udp,0,0,0,0,0,0 sslvpn0=sslvpn,0,0,0,0,0,0 ipsec=ipsec,0,0,0,0,0,0 Ethernet1=in,8,40,8,40,0,0 Ethernet0=out,86,424,177,536,75,0 Qid0=BYPASS_out,0,16032,0,0,82,0 Qid1=BYPASS_in,0,656,0,0,0,0 Qid2=BYPASS_ipsec,0,0,0,0,0,0 mem=0,0,0,0,0,0,0,0 logtype=\"monitor\"", "start": "2024-03-08T17:31:09.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -371,16 +419,27 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 18:14:59\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 18:14:59\" pri=5 service=userreqd msg=\"reloading daemon configuration (reason: SIGHUP)\" logtype=\"system\"", "start": "2024-03-08T18:14:59.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "reloading daemon configuration (reason: SIGHUP)", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, + "process": { + "name": "userreqd" + }, "stormshield": { "fw": "stormy-1", "logtype": "system", @@ -402,16 +461,27 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 18:15:00\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 18:15:00\" pri=5 service=routerd msg=\"routerd daemon configuration reloaded, modules: pbr_route, ip_version: all (reason: Refresh)\" logtype=\"system\"", "start": "2024-03-08T18:15:00.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "routerd daemon configuration reloaded, modules: pbr_route, ip_version: all (reason: Refresh)", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, + "process": { + "name": "routerd" + }, "stormshield": { "fw": "stormy-1", "logtype": "system", @@ -430,6 +500,7 @@ { "@timestamp": "2019-02-24T16:38:01.000+01:00", "destination": { + "bytes": 0, "ip": "10.10.10.10", "port": 1900 }, @@ -438,22 +509,42 @@ }, "event": { "action": "pass", + "category": [ + "network" + ], "duration": 0, + "kind": "event", "original": "id=firewall time=\"2019-02-24 16:38:01\" fw=\"SN310A17B0323A7\" tz=+0100 startime=\"2019-02-24 16:38:00\" pri=5 confid=00 slotlevel=2 ruleid=4 rulename=\"1690fb96019_7\" srcif=\"Ethernet0\" srcifname=\"out\" ipproto=udp proto=ssdp src=10.11.11.11 srcport=49907 srcportname=ephemeral_fw_udp srcname=user1 srcmac=11:11:11:11:11:11 dst=10.10.10.10 dstport=1900 dstportname=sdp ipv=4 sent=0 rcvd=0 duration=0.00 action=pass logtype=\"filter\"", "start": "2019-02-24T16:38:00.000+01:00", - "timezone": "+01:00" + "timezone": "+01:00", + "type": [ + "connection", + "allowed" + ] }, "network": { + "bytes": 0, + "direction": "internal", "protocol": "ssdp", "transport": "udp", "type": "ipv4" }, "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "SN310A17B0323A7", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "user1" + ], "ip": [ "10.11.11.11", "10.10.10.10" @@ -498,13 +589,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"CONFIG LOG SHOW\" logtype=\"server\"", + "outcome": "success", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "CONFIG LOG SHOW", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -538,13 +638,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"PKI SEARCH scope=local type=ca\" logtype=\"server\"", + "outcome": "success", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "PKI SEARCH scope=local type=ca", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -575,6 +684,7 @@ { "@timestamp": "2024-03-08T10:14:08.000Z", "destination": { + "bytes": 3614, "domain": "Firewall_out", "ip": "192.168.197.134", "port": 443 @@ -584,22 +694,44 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 10000000, + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" pri=5 confid=00 slotlevel=0 ruleid=4 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp proto=ssl version=TLSv1.3 src=192.168.197.1 srcport=61549 srcportname=ad2008-dyn_tcp srcmac=00:50:56:c0:00:08 dst=192.168.197.134 dstport=443 dstportname=https dstname=Firewall_out modsrc=192.168.197.1 modsrcport=61549 origdst=192.168.197.134 origdstport=443 ipv=4 sent=605 rcvd=3614 duration=0.01 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 4219, + "direction": "internal", "protocol": "ssl", "transport": "tcp", "type": "ipv4" }, "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out" + ], "ip": [ "192.168.197.1", "192.168.197.134" @@ -643,13 +775,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"SYSTEM LOGDISK LIST\" logtype=\"server\"", + "outcome": "success", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "SYSTEM LOGDISK LIST", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -683,13 +824,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"CONFIG COMMUNICATION SYSLOG PROFILE SHOW index=0\" logtype=\"server\"", + "outcome": "success", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "CONFIG COMMUNICATION SYSLOG PROFILE SHOW index=0", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -720,6 +870,7 @@ { "@timestamp": "2024-03-08T10:14:08.000Z", "destination": { + "bytes": 3614, "domain": "Firewall_out", "ip": "192.168.197.134", "port": 443 @@ -729,22 +880,44 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 320000000, + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" pri=5 confid=00 slotlevel=0 ruleid=4 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp proto=ssl version=TLSv1.3 src=192.168.197.1 srcport=61548 srcportname=ad2008-dyn_tcp srcmac=00:50:56:c0:00:08 dst=192.168.197.134 dstport=443 dstportname=https dstname=Firewall_out modsrc=192.168.197.1 modsrcport=61548 origdst=192.168.197.134 origdstport=443 ipv=4 sent=573 rcvd=3614 duration=0.32 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 4187, + "direction": "internal", "protocol": "ssl", "transport": "tcp", "type": "ipv4" }, "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out" + ], "ip": [ "192.168.197.1", "192.168.197.134" @@ -785,6 +958,7 @@ { "@timestamp": "2024-03-08T10:14:08.000Z", "destination": { + "bytes": 3614, "domain": "Firewall_out", "ip": "192.168.197.134", "port": 443 @@ -794,22 +968,44 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 320000000, + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" pri=5 confid=00 slotlevel=0 ruleid=4 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp proto=ssl version=TLSv1.3 src=192.168.197.1 srcport=61550 srcportname=ad2008-dyn_tcp srcmac=00:50:56:c0:00:08 dst=192.168.197.134 dstport=443 dstportname=https dstname=Firewall_out modsrc=192.168.197.1 modsrcport=61550 origdst=192.168.197.134 origdstport=443 ipv=4 sent=605 rcvd=3614 duration=0.32 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 4219, + "direction": "internal", "protocol": "ssl", "transport": "tcp", "type": "ipv4" }, "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out" + ], "ip": [ "192.168.197.1", "192.168.197.134" @@ -850,6 +1046,7 @@ { "@timestamp": "2024-03-08T10:14:09.000Z", "destination": { + "bytes": 300, "ip": "192.168.236.254", "port": 67 }, @@ -858,22 +1055,44 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 0, + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:09\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:12:09\" pri=5 confid=01 slotlevel=0 ruleid=7 ipproto=udp dstif=\"Ethernet1\" dstifname=\"in\" proto=bootps src=192.168.236.131 srcport=68 srcportname=bootpc srcname=Firewall_in dst=192.168.236.254 dstport=67 dstportname=bootps modsrc=192.168.236.131 modsrcport=68 origdst=192.168.236.254 origdstport=67 ipv=4 sent=300 rcvd=300 duration=0.00 action=pass logtype=\"connection\"", "start": "2024-03-08T10:12:09.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 600, + "direction": "internal", "protocol": "bootps", "transport": "udp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_in" + ], "ip": [ "192.168.236.131", "192.168.236.254" @@ -916,13 +1135,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:11\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:11\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"CONFIG ACTIVATE cancelall\" logtype=\"server\"", + "outcome": "success", "start": "2024-03-08T10:14:11.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "CONFIG ACTIVATE cancelall", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -956,13 +1184,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:11\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:11\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"SYSTEM IDENT\" logtype=\"server\"", + "outcome": "success", "start": "2024-03-08T10:14:11.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "SYSTEM IDENT", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -996,13 +1233,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:11\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:11\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"SYSTEM LANGUAGE\" logtype=\"server\"", + "outcome": "success", "start": "2024-03-08T10:14:11.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "SYSTEM LANGUAGE", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -1036,16 +1282,27 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:48\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:48\" pri=5 service=routerd msg=\"The gateway of the router is now used for routing router:Firewall_out_router gateway:Firewall_out_router ipv:4 (192.168.197.2)\" logtype=\"system\"", "start": "2024-03-08T15:14:48.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "The gateway of the router is now used for routing router:Firewall_out_router gateway:Firewall_out_router ipv:4 (192.168.197.2)", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, + "process": { + "name": "routerd" + }, "stormshield": { "fw": "stormy-1", "logtype": "system", @@ -1067,16 +1324,27 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:48\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:48\" pri=5 service=routerd msg=\"routerd daemon configuration reloaded, modules: pbr_route, ip_version: all (reason: Refresh)\" logtype=\"system\"", "start": "2024-03-08T15:14:48.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "routerd daemon configuration reloaded, modules: pbr_route, ip_version: all (reason: Refresh)", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, + "process": { + "name": "routerd" + }, "stormshield": { "fw": "stormy-1", "logtype": "system", @@ -1098,13 +1366,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:48\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:48\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"CONFIG DNS ACTIVATE\" logtype=\"server\"", + "outcome": "success", "start": "2024-03-08T15:14:48.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "CONFIG DNS ACTIVATE", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -1141,16 +1418,31 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "code": "82", + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:49\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:48\" pri=5 src=192.168.197.2 dst=0.0.0.0 msg=\"Remote host reachable: through Firewall_out_router(192.168.197.2) on router Firewall_out_router\" service=sysevent alarmid=82 logtype=\"system\"", "start": "2024-03-08T15:14:48.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "Remote host reachable: through Firewall_out_router(192.168.197.2) on router Firewall_out_router", + "network": { + "direction": "outbound" + }, "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, + "process": { + "name": "sysevent" + }, "related": { "ip": [ "192.168.197.2", @@ -1182,12 +1474,20 @@ "version": "8.17.0" }, "event": { + "category": [ + "network" + ], + "kind": "metric", "original": "id=firewall time=\"2024-03-08 15:14:51\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:51\" SavedEvaluation=153 DynamicMem=0 HostMem=0 FragMem=0 ICMPMem=0 ConnMem=0 AssocMem=0 EtherStateMem=0 IPStateMem=0 DTrackMem=0 Logged=10 LogOverflow=0 HostrepMax=0 HostrepScore=0 HostrepRequests=0 PvmFacts=0 PvmOverflow=0 Accepted=289 Blocked=0 Byte(i/o)=97364/145065 Fragmented=0 TCPPacket=178 TCPByte(i/o)=86297/116839 TCPConn=3 TCPConnNatSrc=0 TCPConnNatDst=0 TCPConnNoNatSrc=0 TCPConnNoNatDst=0 UDPPacket=111 UDPByte(i/o)=11067/28226 UDPConn=0 UDPConnNatSrc=0 UDPConnNatDst=0 UDPConnNoNatSrc=0 UDPConnNoNatDst=0 ICMPPacket=0 ICMPByte(i/o)=0/0 IPStatePacket=0 IPStateByte(i/o)=0/0 IPStateConn=0 IPStateConnNatSrc=0 IPStateConnNatDst=0 IPStateConnNoNatSrc=0 IPStateConnNoNatDst=0 SCTPAssocPacket=0 SCTPAssocByte(i/o)=0/0 SCTPAssoc=0 EtherStatePacket=0 EtherStateByte(i/o)=0/0 EtherStateConn=0 TLSCertCacheEntriesNb=0 TLSCertCacheLookup(miss/total)=0/0 TLSCertCacheInsert=0 TLSCertCacheFlushOp=0 TLSCertCachePurgeOp=0 TLSCertCacheFlushedNb=0 TLSCertCachePurgedNb=0 TLSCertCacheExpiredNb=0 logtype=\"filterstat\"", "start": "2024-03-08T15:14:51.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -1294,16 +1594,27 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:54\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:54\" pri=5 service=userreqd msg=\"reloading daemon configuration (reason: SIGHUP)\" logtype=\"system\"", "start": "2024-03-08T15:14:54.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "reloading daemon configuration (reason: SIGHUP)", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, + "process": { + "name": "userreqd" + }, "stormshield": { "fw": "stormy-1", "logtype": "system", @@ -1325,16 +1636,28 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "code": "41", + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:55\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:54\" pri=5 msg=\"Active Update: update successful IPData\" service=sysevent alarmid=41 logtype=\"system\"", "start": "2024-03-08T10:14:54.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "Active Update: update successful IPData", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, + "process": { + "name": "sysevent" + }, "stormshield": { "fw": "stormy-1", "logtype": "system", @@ -1357,13 +1680,22 @@ "version": "8.17.0" }, "event": { + "category": [ + "configuration" + ], + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:56\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 15:14:56\" error=1 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"QUIT\" logtype=\"server\"", + "outcome": "failure", "start": "2024-03-08T15:14:56.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "message": "QUIT", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -1397,13 +1729,24 @@ "version": "8.17.0" }, "event": { + "category": [ + "intrusion_detection", + "network" + ], + "code": "3", + "kind": "alert", "original": "id=firewall time=\"2024-03-08 15:14:57\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:56\" pri=4 msg=\"Connection terminated for webadmin (timeout)\" class=system alarmid=3 logtype=\"alarm\"", + "severity": 4, "start": "2024-03-08T10:14:56.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "Connection terminated for webadmin (timeout)", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, @@ -1426,6 +1769,7 @@ { "@timestamp": "2024-03-08T15:14:57.000Z", "destination": { + "bytes": 921861, "domain": "update2-sns.stormshieldcs.eu", "geo": { "country_iso_code": "fr" @@ -1438,22 +1782,45 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 2147483647, + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:57\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:51\" pri=5 confid=01 slotlevel=0 ruleid=7 ipproto=tcp dstif=\"Ethernet0\" dstifname=\"out\" proto=https src=192.168.197.134 srcport=19883 srcname=Firewall_out dst=192.168.36.20 dstport=443 dstportname=https dstname=update2-sns.stormshieldcs.eu dstcontinent=\"eu\" dstcountry=\"fr\" modsrc=192.168.197.134 modsrcport=19883 origdst=192.168.36.20 origdstport=443 ipv=4 sent=3721 rcvd=921861 duration=5.52 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:51.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 925582, + "direction": "internal", "protocol": "https", "transport": "tcp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out", + "update2-sns.stormshieldcs.eu" + ], "ip": [ "192.168.197.134", "192.168.36.20" @@ -1493,6 +1860,7 @@ { "@timestamp": "2024-03-08T15:14:57.000Z", "destination": { + "bytes": 4863757, "domain": "update1-sns.stormshieldcs.eu", "geo": { "country_iso_code": "fr" @@ -1505,22 +1873,45 @@ }, "event": { "action": "pass", + "category": [ + "network", + "session" + ], "duration": 2147483647, + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:57\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:54\" pri=5 confid=01 slotlevel=0 ruleid=7 ipproto=tcp dstif=\"Ethernet0\" dstifname=\"out\" proto=https src=192.168.197.134 srcport=15908 srcname=Firewall_out dst=192.168.36.4 dstport=443 dstportname=https dstname=update1-sns.stormshieldcs.eu dstcontinent=\"eu\" dstcountry=\"fr\" modsrc=192.168.197.134 modsrcport=15908 origdst=192.168.36.4 origdstport=443 ipv=4 sent=1467 rcvd=4863757 duration=2.98 action=pass logtype=\"connection\"", "start": "2024-03-08T10:14:54.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "connection", + "end", + "allowed" + ] }, "network": { + "bytes": 4865224, + "direction": "internal", "protocol": "https", "transport": "tcp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "Firewall_out", + "update1-sns.stormshieldcs.eu" + ], "ip": [ "192.168.197.134", "192.168.36.4" @@ -1563,16 +1954,28 @@ "version": "8.17.0" }, "event": { + "category": [ + "host" + ], + "code": "41", + "kind": "event", "original": "id=firewall time=\"2024-03-08 15:14:58\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:56\" pri=5 msg=\"Active Update: update successful CompromisedUrls\" service=sysevent logtype=\"system\" alarmid=41", "start": "2024-03-08T10:14:56.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "info" + ] }, "message": "Active Update: update successful CompromisedUrls", "observer": { "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, + "process": { + "name": "sysevent" + }, "stormshield": { "fw": "stormy-1", "logtype": "system", @@ -1598,6 +2001,7 @@ "name": "Telstra Pty Ltd" } }, + "bytes": 177, "domain": "connectivity-check.ubuntu.com", "geo": { "country_iso_code": "us" @@ -1610,22 +2014,49 @@ }, "event": { "action": "pass", + "category": [ + "network" + ], "duration": 60000000, + "kind": "event", "original": "id=firewall time=\"2024-06-07 18:46:18\" fw=\"stormy-1\" tz=+0000 startime=\"2024-06-07 10:40:42\" pri=5 confid=01 slotlevel=2 ruleid=7 srcif=\"Ethernet1\" srcifname=\"segment0\" ipproto=tcp dstif=\"Ethernet0\" dstifname=\"out\" proto=http src=89.160.20.128 srcport=55008 srcportname=ephemeral_fw_tcp srcname=vm-internal srcmac=00:0c:29:8d:6c:55 srccontinent=\"eu\" srccountry=\"se\" dst=1.128.91.48 dstport=80 dstportname=http dstname=connectivity-check.ubuntu.com dstcontinent=\"na\" dstcountry=\"us\" modsrc=192.168.197.134 modsrcport=55008 origdst=1.128.91.48 origdstport=80 ipv=4 sent=77 rcvd=177 duration=0.06 action=pass op=GET result=204 arg=\"/\" logtype=\"plugin\"", "start": "2024-06-07T10:40:42.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "protocol", + "allowed" + ] }, "network": { + "bytes": 254, + "direction": "external", "protocol": "http", "transport": "tcp", "type": "ipv4" }, "observer": { + "egress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "segment0" + } + }, "name": "stormy-1", + "product": "SNS", "type": "firewall", "vendor": "Stormshield" }, "related": { + "hosts": [ + "vm-internal", + "connectivity-check.ubuntu.com" + ], "ip": [ "89.160.20.128", "192.168.197.134", diff --git a/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log new file mode 100644 index 00000000000..8da03a3a946 --- /dev/null +++ b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log @@ -0,0 +1,18 @@ +id=firewall time="2019-01-27 13:24:28" fw="V50XXA0G0000002" tz=+0000 startime="2019-01-27 13:24:28" pri=4 srcif="Ethernet0" srcifname="out" ipproto=tcp proto=ssh src=192.168.0.1 srcport=54937 srcportname=ephemeral_fw dst=192.168.1.1 dstport=22 dstportname=ssh dstname=Firewall_out action=pass msg="Interactive connection detected" class=protocol classification=0 alarmid=85 logtype="alarm" +id=firewall time="2026-03-02 11:05:33" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 11:05:33" pri=1 class=protocol classification=0 alarmid=157 sensible=1 risk=85 target=dst repeat=3 srcif="Ethernet1" srcifname="in" ipproto=tcp proto=http src=192.0.2.10 srcport=51234 srcportname=ephemeral_fw_tcp dst=192.0.2.80 dstport=80 dstportname=http ipv=4 action=block msg="Possible port scan" logtype="alarm" +id=firewall time="2026-03-02 09:12:41" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 09:12:41" user="jdoe" domain="documentation" usergroup=group1,group2,group3 src=192.0.2.25 ruleid=2 confid=00 error=0 method="" totp=no msg="User authenticated" logtype="auth" +id=firewall time="2026-03-02 09:13:05" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 09:13:05" user="jdoe" domain="documentation" src=192.0.2.25 ruleid=2 confid=00 error=1 agentid=1 msg="Authentication failed" logtype="auth" +id=firewall time="2026-03-02 10:30:12" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 10:30:11" pri=5 srcif="Ethernet1" srcifname="in" ipproto=tcp proto=http src=192.168.10.25 srcport=52000 srcportname=ephemeral_fw_tcp dst=198.51.100.20 dstport=80 dstportname=http dstname=www.example.com modsrc=203.0.113.1 modsrcport=52000 origdst=198.51.100.20 origdstport=80 ipv=4 sent=512 rcvd=2048 duration=0.42 user="jdoe" op=GET result=200 arg="/index.html" cat_site="{news}" contentpolicy=00 action=pass logtype="web" +id=firewall time="2026-03-02 10:31:44" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 10:31:44" pri=5 srcif="Ethernet1" srcifname="in" ipproto=tcp proto=http src=192.168.10.25 srcport=52014 srcportname=ephemeral_fw_tcp dst=198.51.100.30 dstport=80 dstportname=http dstname=blocked.example.com ipv=4 sent=256 rcvd=0 duration=0.05 user="jdoe" op=GET result=403 arg="/download.exe" cat_site="{malware}" contentpolicy=00 action=Block logtype="web" +id=firewall time="2026-03-02 08:00:05" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 08:00:03" pri=5 phase=1 side=initiator ikev=2 peername="remote_gateway" remoteid=203.0.113.50 cookie_i=0x45718953174ba1b9 cookie_r=0x93b571aa2f43d0d1 src=203.0.113.1 srcname=Firewall_out dst=203.0.113.50 dstname=remote_gateway msg="Phase established" logtype="vpn" +id=firewall time="2026-03-02 08:00:06" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 08:00:05" pri=5 phase=2 side=responder ikev=2 user="jdoe" usergroup="ipsec-group" spi_in=0x0c9f2ea1 spi_out=0x1a4b3c2d localnet=192.168.1.0/24 remotenet=192.168.2.0/24 src=203.0.113.1 srcname=Firewall_out dst=203.0.113.50 dstname=remote_gateway msg="Phase established" logtype="vpn" +id=firewall time="2026-03-02 12:00:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 12:00:00" Rule2:8=1612 Rule1:3=245781 logtype="count" +id=firewall time="2026-03-02 12:05:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 12:05:00" Rule2:8=abc Rule9:12=77 Rule1:3:5=9 Rule0:2=512 logtype="count" +id=firewall time="2026-03-02 09:45:22" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 09:45:22" user="jdoe" domain="documentation" error=0 src=203.0.113.77 srcname=remote_laptop msg="SSL VPN tunnel opened" duration=0 totp=yes logtype="xvpn" +id=firewall time="2026-03-02 14:20:10" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 14:20:10" pri=5 confid=00 slotlevel=2 ruleid=12 srcif="Ethernet1" srcifname="in" ipproto=udp src=192.0.2.30 srcport=5353 dst=192.0.2.251 dstport=5353 dstportname=mdns ipv=4 action= logtype="filter" +id=firewall time="2026-03-02 16:10:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 16:09:59" pri=5 srcif="Ethernet0" srcifname="out" ipproto=udp proto=dns src=192.0.2.50 srcport=51000 srcportname=ephemeral_fw_udp dst=192.168.1.10 dstport=53 dstportname=domain_udp origdst=192.168.200.1 origdstport=53 modsrc=203.0.113.1 modsrcport=51000 ipv=4 sent=64 rcvd=128 duration=0.02 logtype="connection" +id=firewall time="2026-03-02 16:20:05" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 16:20:05" pri=1 class=protocol classification=0 alarmid=85 repeat=1 srcif="Ethernet0" srcifname="out" ipproto=tcp src=203.0.113.66 srcport=44012 srciprep="anonymizer,tor" srchostrep=26123 dst=192.0.2.80 dstport=443 dstportname=https dstiprep=spam dsthostrep=41 ipv=4 pktlen=33 pktdumplen=20 pktdump=45000021004300004006a83bcb007142c0000250 action=block msg="Port probe detected" logtype="alarm" +id=firewall time="2026-03-02 16:30:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 16:30:00" pri=5 srcif="Ethernet1" srcifname="in" ipproto=tcp proto=modbus src=192.168.10.40 srcport=50200 dst=192.168.20.5 dstport=502 dstportname=modbus ipv=4 unitid=1 result=5 action=pass logtype="plugin" +id=firewall time="2026-03-02 16:40:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 16:40:00" user="admin" address=192.0.2.9 sessionid=41 msg="SYSTEM RIGHT WRITE ON" error=0 logtype="server" +id=firewall time="2026-03-02 16:50:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 16:50:00" pri=5 service="SSOAgent" msg="Service started" logtype="system" +id=firewall time="2026-03-02 15:00:00" fw="SN310A0000000001" tz=+0100 startime="2026-03-02 15:00:00" pri=5 msg="sample from a log family unknown to the categorization table" logtype="futuretype" diff --git a/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log-expected.json b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log-expected.json new file mode 100644 index 00000000000..2a04c76d9f8 --- /dev/null +++ b/packages/stormshield/data_stream/log/_dev/test/pipeline/test-log-families.log-expected.json @@ -0,0 +1,1528 @@ +{ + "expected": [ + { + "@timestamp": "2019-01-27T13:24:28.000Z", + "destination": { + "domain": "Firewall_out", + "ip": "192.168.1.1", + "port": 22 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "pass", + "category": [ + "intrusion_detection", + "network" + ], + "code": "85", + "kind": "alert", + "original": "id=firewall time=\"2019-01-27 13:24:28\" fw=\"V50XXA0G0000002\" tz=+0000 startime=\"2019-01-27 13:24:28\" pri=4 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp proto=ssh src=192.168.0.1 srcport=54937 srcportname=ephemeral_fw dst=192.168.1.1 dstport=22 dstportname=ssh dstname=Firewall_out action=pass msg=\"Interactive connection detected\" class=protocol classification=0 alarmid=85 logtype=\"alarm\"", + "severity": 4, + "start": "2019-01-27T13:24:28.000Z", + "timezone": "+00:00", + "type": [ + "info", + "allowed" + ] + }, + "message": "Interactive connection detected", + "network": { + "direction": "internal", + "protocol": "ssh", + "transport": "tcp" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, + "name": "V50XXA0G0000002", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "Firewall_out" + ], + "ip": [ + "192.168.0.1", + "192.168.1.1" + ] + }, + "source": { + "ip": "192.168.0.1", + "port": 54937 + }, + "stormshield": { + "fw": "V50XXA0G0000002", + "logtype": "alarm", + "metadata": { + "alarmid": "85", + "class": "protocol", + "classification": "0", + "dstportname": "ssh", + "id": "firewall", + "pri": "4", + "srcportname": "ephemeral_fw" + }, + "srcif": "Ethernet0", + "srcifname": "out", + "startime": "2019-01-27 13:24:28", + "time": "2019-01-27 13:24:28" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T11:05:33.000+01:00", + "destination": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.80", + "port": 80 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "block", + "category": [ + "intrusion_detection", + "network" + ], + "code": "157", + "kind": "alert", + "original": "id=firewall time=\"2026-03-02 11:05:33\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 11:05:33\" pri=1 class=protocol classification=0 alarmid=157 sensible=1 risk=85 target=dst repeat=3 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=tcp proto=http src=192.0.2.10 srcport=51234 srcportname=ephemeral_fw_tcp dst=192.0.2.80 dstport=80 dstportname=http ipv=4 action=block msg=\"Possible port scan\" logtype=\"alarm\"", + "risk_score": 85.0, + "severity": 1, + "start": "2026-03-02T11:05:33.000+01:00", + "timezone": "+01:00", + "type": [ + "info", + "denied" + ] + }, + "message": "Possible port scan", + "network": { + "direction": "external", + "protocol": "http", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.10", + "192.0.2.80" + ] + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10", + "port": 51234 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "alarm", + "metadata": { + "alarmid": "157", + "class": "protocol", + "classification": "0", + "dstportname": "http", + "id": "firewall", + "pri": "1", + "repeat": "3", + "risk": "85", + "sensible": "1", + "srcportname": "ephemeral_fw_tcp", + "target": "dst" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 11:05:33", + "time": "2026-03-02 11:05:33" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T09:12:41.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "authentication" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 09:12:41\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 09:12:41\" user=\"jdoe\" domain=\"documentation\" usergroup=group1,group2,group3 src=192.0.2.25 ruleid=2 confid=00 error=0 method=\"\" totp=no msg=\"User authenticated\" logtype=\"auth\"", + "outcome": "success", + "start": "2026-03-02T09:12:41.000+01:00", + "timezone": "+01:00", + "type": [ + "start" + ] + }, + "message": "User authenticated", + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.25" + ], + "user": [ + "jdoe" + ] + }, + "rule": { + "id": "2" + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.25" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "auth", + "metadata": { + "confid": "00", + "domain": "documentation", + "error": "0", + "id": "firewall", + "method": "", + "totp": "no", + "usergroup": "group1,group2,group3" + }, + "startime": "2026-03-02 09:12:41", + "time": "2026-03-02 09:12:41" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "documentation", + "group": { + "name": [ + "group1", + "group2", + "group3" + ] + }, + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T09:13:05.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "authentication" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 09:13:05\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 09:13:05\" user=\"jdoe\" domain=\"documentation\" src=192.0.2.25 ruleid=2 confid=00 error=1 agentid=1 msg=\"Authentication failed\" logtype=\"auth\"", + "outcome": "failure", + "start": "2026-03-02T09:13:05.000+01:00", + "timezone": "+01:00", + "type": [ + "start" + ] + }, + "message": "Authentication failed", + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.25" + ], + "user": [ + "jdoe" + ] + }, + "rule": { + "id": "2" + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.25" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "auth", + "metadata": { + "agentid": "1", + "confid": "00", + "domain": "documentation", + "error": "1", + "id": "firewall" + }, + "startime": "2026-03-02 09:13:05", + "time": "2026-03-02 09:13:05" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "documentation", + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T10:30:12.000+01:00", + "destination": { + "as": { + "number": 64501, + "organization": { + "name": "Documentation ASN" + } + }, + "bytes": 2048, + "domain": "www.example.com", + "geo": { + "city_name": "Amsterdam", + "continent_name": "Europe", + "country_iso_code": "NL", + "country_name": "Netherlands", + "location": { + "lat": 52.37404, + "lon": 4.88969 + }, + "region_iso_code": "NL-NH", + "region_name": "North Holland" + }, + "ip": "198.51.100.20", + "port": 80 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "pass", + "category": [ + "web", + "network" + ], + "duration": 420000000, + "kind": "event", + "original": "id=firewall time=\"2026-03-02 10:30:12\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 10:30:11\" pri=5 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=tcp proto=http src=192.168.10.25 srcport=52000 srcportname=ephemeral_fw_tcp dst=198.51.100.20 dstport=80 dstportname=http dstname=www.example.com modsrc=203.0.113.1 modsrcport=52000 origdst=198.51.100.20 origdstport=80 ipv=4 sent=512 rcvd=2048 duration=0.42 user=\"jdoe\" op=GET result=200 arg=\"/index.html\" cat_site=\"{news}\" contentpolicy=00 action=pass logtype=\"web\"", + "start": "2026-03-02T10:30:11.000+01:00", + "timezone": "+01:00", + "type": [ + "access", + "allowed" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 200 + } + }, + "network": { + "bytes": 2560, + "direction": "outbound", + "protocol": "http", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "www.example.com" + ], + "ip": [ + "192.168.10.25", + "203.0.113.1", + "198.51.100.20" + ], + "user": [ + "jdoe" + ] + }, + "source": { + "bytes": 512, + "ip": "192.168.10.25", + "nat": { + "ip": "203.0.113.1", + "port": 52000 + }, + "port": 52000 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "web", + "metadata": { + "arg": "/index.html", + "cat_site": "{news}", + "contentpolicy": "00", + "dstportname": "http", + "id": "firewall", + "op": "GET", + "pri": "5", + "rcvd": "2048", + "result": "200", + "sent": "512", + "srcportname": "ephemeral_fw_tcp" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 10:30:11", + "time": "2026-03-02 10:30:12" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "www.example.com", + "original": "/index.html" + }, + "user": { + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T10:31:44.000+01:00", + "destination": { + "as": { + "number": 64501, + "organization": { + "name": "Documentation ASN" + } + }, + "bytes": 0, + "domain": "blocked.example.com", + "geo": { + "city_name": "Amsterdam", + "continent_name": "Europe", + "country_iso_code": "NL", + "country_name": "Netherlands", + "location": { + "lat": 52.37404, + "lon": 4.88969 + }, + "region_iso_code": "NL-NH", + "region_name": "North Holland" + }, + "ip": "198.51.100.30", + "port": 80 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Block", + "category": [ + "web", + "network" + ], + "duration": 50000000, + "kind": "event", + "original": "id=firewall time=\"2026-03-02 10:31:44\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 10:31:44\" pri=5 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=tcp proto=http src=192.168.10.25 srcport=52014 srcportname=ephemeral_fw_tcp dst=198.51.100.30 dstport=80 dstportname=http dstname=blocked.example.com ipv=4 sent=256 rcvd=0 duration=0.05 user=\"jdoe\" op=GET result=403 arg=\"/download.exe\" cat_site=\"{malware}\" contentpolicy=00 action=Block logtype=\"web\"", + "start": "2026-03-02T10:31:44.000+01:00", + "timezone": "+01:00", + "type": [ + "access", + "denied" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 403 + } + }, + "network": { + "bytes": 256, + "direction": "outbound", + "protocol": "http", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "blocked.example.com" + ], + "ip": [ + "192.168.10.25", + "198.51.100.30" + ], + "user": [ + "jdoe" + ] + }, + "source": { + "bytes": 256, + "ip": "192.168.10.25", + "port": 52014 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "web", + "metadata": { + "arg": "/download.exe", + "cat_site": "{malware}", + "contentpolicy": "00", + "dstportname": "http", + "id": "firewall", + "op": "GET", + "pri": "5", + "rcvd": "0", + "result": "403", + "sent": "256", + "srcportname": "ephemeral_fw_tcp" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 10:31:44", + "time": "2026-03-02 10:31:44" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "blocked.example.com", + "original": "/download.exe" + }, + "user": { + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T08:00:05.000+01:00", + "destination": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "domain": "remote_gateway", + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.50" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 08:00:05\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 08:00:03\" pri=5 phase=1 side=initiator ikev=2 peername=\"remote_gateway\" remoteid=203.0.113.50 cookie_i=0x45718953174ba1b9 cookie_r=0x93b571aa2f43d0d1 src=203.0.113.1 srcname=Firewall_out dst=203.0.113.50 dstname=remote_gateway msg=\"Phase established\" logtype=\"vpn\"", + "start": "2026-03-02T08:00:03.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "message": "Phase established", + "network": { + "direction": "external" + }, + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "Firewall_out", + "remote_gateway" + ], + "ip": [ + "203.0.113.1", + "203.0.113.50" + ] + }, + "source": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.1" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "vpn", + "metadata": { + "cookie_i": "0x45718953174ba1b9", + "cookie_r": "0x93b571aa2f43d0d1", + "id": "firewall", + "ikev": "2", + "peername": "remote_gateway", + "phase": "1", + "pri": "5", + "remoteid": "203.0.113.50", + "side": "initiator", + "srcname": "Firewall_out" + }, + "startime": "2026-03-02 08:00:03", + "time": "2026-03-02 08:00:05" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T08:00:06.000+01:00", + "destination": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "domain": "remote_gateway", + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.50" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 08:00:06\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 08:00:05\" pri=5 phase=2 side=responder ikev=2 user=\"jdoe\" usergroup=\"ipsec-group\" spi_in=0x0c9f2ea1 spi_out=0x1a4b3c2d localnet=192.168.1.0/24 remotenet=192.168.2.0/24 src=203.0.113.1 srcname=Firewall_out dst=203.0.113.50 dstname=remote_gateway msg=\"Phase established\" logtype=\"vpn\"", + "start": "2026-03-02T08:00:05.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "message": "Phase established", + "network": { + "direction": "external" + }, + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "Firewall_out", + "remote_gateway" + ], + "ip": [ + "203.0.113.1", + "203.0.113.50" + ], + "user": [ + "jdoe" + ] + }, + "source": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.1" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "vpn", + "metadata": { + "id": "firewall", + "ikev": "2", + "localnet": "192.168.1.0/24", + "phase": "2", + "pri": "5", + "remotenet": "192.168.2.0/24", + "side": "responder", + "spi_in": "0x0c9f2ea1", + "spi_out": "0x1a4b3c2d", + "srcname": "Firewall_out", + "usergroup": "ipsec-group" + }, + "startime": "2026-03-02 08:00:05", + "time": "2026-03-02 08:00:06" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "group": { + "name": [ + "ipsec-group" + ] + }, + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T12:00:00.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "metric", + "original": "id=firewall time=\"2026-03-02 12:00:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 12:00:00\" Rule2:8=1612 Rule1:3=245781 logtype=\"count\"", + "start": "2026-03-02T12:00:00.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "count", + "metadata": { + "id": "firewall", + "rule_stats": [ + { + "byte_count": 245781, + "category": "Global Filter Rule", + "original": "Rule1:3", + "rule_number": 3 + }, + { + "byte_count": 1612, + "category": "Local Filter Rule", + "original": "Rule2:8", + "rule_number": 8 + } + ] + }, + "startime": "2026-03-02 12:00:00", + "time": "2026-03-02 12:00:00" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T12:05:00.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "metric", + "original": "id=firewall time=\"2026-03-02 12:05:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 12:05:00\" Rule2:8=abc Rule9:12=77 Rule1:3:5=9 Rule0:2=512 logtype=\"count\"", + "start": "2026-03-02T12:05:00.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "count", + "metadata": { + "id": "firewall", + "rule_stats": [ + { + "byte_count": 512, + "category": "Implicit Filter Rule", + "original": "Rule0:2", + "rule_number": 2 + } + ] + }, + "startime": "2026-03-02 12:05:00", + "time": "2026-03-02 12:05:00" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T09:45:22.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 0, + "kind": "event", + "original": "id=firewall time=\"2026-03-02 09:45:22\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 09:45:22\" user=\"jdoe\" domain=\"documentation\" error=0 src=203.0.113.77 srcname=remote_laptop msg=\"SSL VPN tunnel opened\" duration=0 totp=yes logtype=\"xvpn\"", + "outcome": "success", + "start": "2026-03-02T09:45:22.000+01:00", + "timezone": "+01:00", + "type": [ + "connection" + ] + }, + "message": "SSL VPN tunnel opened", + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "hosts": [ + "remote_laptop" + ], + "ip": [ + "203.0.113.77" + ], + "user": [ + "jdoe" + ] + }, + "source": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.77" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "xvpn", + "metadata": { + "domain": "documentation", + "error": "0", + "id": "firewall", + "srcname": "remote_laptop", + "totp": "yes" + }, + "startime": "2026-03-02 09:45:22", + "time": "2026-03-02 09:45:22" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "documentation", + "name": "jdoe" + } + }, + { + "@timestamp": "2026-03-02T14:20:10.000+01:00", + "destination": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.251", + "port": 5353 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 14:20:10\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 14:20:10\" pri=5 confid=00 slotlevel=2 ruleid=12 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=udp src=192.0.2.30 srcport=5353 dst=192.0.2.251 dstport=5353 dstportname=mdns ipv=4 action= logtype=\"filter\"", + "start": "2026-03-02T14:20:10.000+01:00", + "timezone": "+01:00", + "type": [ + "connection" + ] + }, + "network": { + "direction": "external", + "transport": "udp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.30", + "192.0.2.251" + ] + }, + "rule": { + "id": "12" + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.30", + "port": 5353 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "filter", + "metadata": { + "confid": "00", + "dstportname": "mdns", + "id": "firewall", + "pri": "5", + "slotlevel": "2" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 14:20:10", + "time": "2026-03-02 14:20:10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T16:10:00.000+01:00", + "destination": { + "bytes": 128, + "ip": "192.168.200.1", + "nat": { + "ip": "192.168.1.10", + "port": 53 + }, + "port": 53 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 20000000, + "kind": "event", + "original": "id=firewall time=\"2026-03-02 16:10:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 16:09:59\" pri=5 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=udp proto=dns src=192.0.2.50 srcport=51000 srcportname=ephemeral_fw_udp dst=192.168.1.10 dstport=53 dstportname=domain_udp origdst=192.168.200.1 origdstport=53 modsrc=203.0.113.1 modsrcport=51000 ipv=4 sent=64 rcvd=128 duration=0.02 logtype=\"connection\"", + "start": "2026-03-02T16:09:59.000+01:00", + "timezone": "+01:00", + "type": [ + "connection", + "end" + ] + }, + "network": { + "bytes": 192, + "direction": "inbound", + "protocol": "dns", + "transport": "udp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.0.2.50", + "203.0.113.1", + "192.168.200.1", + "192.168.1.10" + ] + }, + "source": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "bytes": 64, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.50", + "nat": { + "ip": "203.0.113.1", + "port": 51000 + }, + "port": 51000 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "connection", + "metadata": { + "dstportname": "domain_udp", + "id": "firewall", + "pri": "5", + "rcvd": "128", + "sent": "64", + "srcportname": "ephemeral_fw_udp" + }, + "srcif": "Ethernet0", + "srcifname": "out", + "startime": "2026-03-02 16:09:59", + "time": "2026-03-02 16:10:00" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T16:20:05.000+01:00", + "destination": { + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.80", + "port": 443 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "block", + "category": [ + "intrusion_detection", + "network" + ], + "code": "85", + "kind": "alert", + "original": "id=firewall time=\"2026-03-02 16:20:05\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 16:20:05\" pri=1 class=protocol classification=0 alarmid=85 repeat=1 srcif=\"Ethernet0\" srcifname=\"out\" ipproto=tcp src=203.0.113.66 srcport=44012 srciprep=\"anonymizer,tor\" srchostrep=26123 dst=192.0.2.80 dstport=443 dstportname=https dstiprep=spam dsthostrep=41 ipv=4 pktlen=33 pktdumplen=20 pktdump=45000021004300004006a83bcb007142c0000250 action=block msg=\"Port probe detected\" logtype=\"alarm\"", + "severity": 1, + "start": "2026-03-02T16:20:05.000+01:00", + "timezone": "+01:00", + "type": [ + "info", + "denied" + ] + }, + "message": "Port probe detected", + "network": { + "direction": "external", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet0", + "name": "out" + } + }, + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "203.0.113.66", + "192.0.2.80" + ] + }, + "source": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.66", + "port": 44012 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "alarm", + "metadata": { + "alarmid": "85", + "class": "protocol", + "classification": "0", + "dsthostrep": "41", + "dstiprep": "spam", + "dstportname": "https", + "id": "firewall", + "pktdump": "45000021004300004006a83bcb007142c0000250", + "pktdumplen": "20", + "pktlen": "33", + "pri": "1", + "repeat": "1", + "srchostrep": "26123", + "srciprep": "anonymizer,tor" + }, + "srcif": "Ethernet0", + "srcifname": "out", + "startime": "2026-03-02 16:20:05", + "time": "2026-03-02 16:20:05" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T16:30:00.000+01:00", + "destination": { + "ip": "192.168.20.5", + "port": 502 + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "pass", + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 16:30:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 16:30:00\" pri=5 srcif=\"Ethernet1\" srcifname=\"in\" ipproto=tcp proto=modbus src=192.168.10.40 srcport=50200 dst=192.168.20.5 dstport=502 dstportname=modbus ipv=4 unitid=1 result=5 action=pass logtype=\"plugin\"", + "start": "2026-03-02T16:30:00.000+01:00", + "timezone": "+01:00", + "type": [ + "protocol", + "allowed" + ] + }, + "network": { + "direction": "internal", + "protocol": "modbus", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "id": "Ethernet1", + "name": "in" + } + }, + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "ip": [ + "192.168.10.40", + "192.168.20.5" + ] + }, + "source": { + "ip": "192.168.10.40", + "port": 50200 + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "plugin", + "metadata": { + "dstportname": "modbus", + "id": "firewall", + "pri": "5", + "result": "5", + "unitid": "1" + }, + "srcif": "Ethernet1", + "srcifname": "in", + "startime": "2026-03-02 16:30:00", + "time": "2026-03-02 16:30:00" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T16:40:00.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "configuration" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 16:40:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 16:40:00\" user=\"admin\" address=192.0.2.9 sessionid=41 msg=\"SYSTEM RIGHT WRITE ON\" error=0 logtype=\"server\"", + "outcome": "success", + "start": "2026-03-02T16:40:00.000+01:00", + "timezone": "+01:00", + "type": [ + "access" + ] + }, + "message": "SYSTEM RIGHT WRITE ON", + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "related": { + "user": [ + "admin" + ] + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "server", + "metadata": { + "address": "192.0.2.9", + "error": "0", + "id": "firewall", + "sessionid": "41" + }, + "startime": "2026-03-02 16:40:00", + "time": "2026-03-02 16:40:00" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "admin" + } + }, + { + "@timestamp": "2026-03-02T16:50:00.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 16:50:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 16:50:00\" pri=5 service=\"SSOAgent\" msg=\"Service started\" logtype=\"system\"", + "start": "2026-03-02T16:50:00.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "message": "Service started", + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "process": { + "name": "SSOAgent" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "system", + "metadata": { + "id": "firewall", + "pri": "5" + }, + "service": "SSOAgent", + "startime": "2026-03-02 16:50:00", + "time": "2026-03-02 16:50:00" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2026-03-02T15:00:00.000+01:00", + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "id=firewall time=\"2026-03-02 15:00:00\" fw=\"SN310A0000000001\" tz=+0100 startime=\"2026-03-02 15:00:00\" pri=5 msg=\"sample from a log family unknown to the categorization table\" logtype=\"futuretype\"", + "start": "2026-03-02T15:00:00.000+01:00", + "timezone": "+01:00", + "type": [ + "info" + ] + }, + "message": "sample from a log family unknown to the categorization table", + "observer": { + "name": "SN310A0000000001", + "product": "SNS", + "type": "firewall", + "vendor": "Stormshield" + }, + "stormshield": { + "fw": "SN310A0000000001", + "logtype": "futuretype", + "metadata": { + "id": "firewall", + "pri": "5" + }, + "startime": "2026-03-02 15:00:00", + "time": "2026-03-02 15:00:00" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml index d723103ae7f..277e8f61f72 100644 --- a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml +++ b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/count.yml @@ -1,10 +1,10 @@ --- -description: Pipeline for processing monitor logs from Stormshield appliances. +description: Pipeline for processing count logs from Stormshield appliances. processors: - script: tag: script_process_devices lang: painless - description: Process device stat fields. + description: Process device stat fields, skipping counters that do not parse. params: devices: - Rule @@ -16,35 +16,53 @@ processors: - Global NAT Rule - Local NAT Rule source: >- - def ruleStats = [:]; + boolean isNumeric(def s) { + if (!(s instanceof String) || s.isEmpty() || s.length() > 18) { + return false; + } + for (int i = 0; i < s.length(); i++) { + if (Character.isDigit(s.charAt(i)) == false) { + return false; + } + } + return true; + } + def ruleStats = []; + def ruleKeys = []; def str = "Rule"; ctx.stormshield.forEach((k, v) -> { - if (k.startsWith(str)) { - def joined = k.substring(str.length()); - def parts = joined.splitByToken(":", 2); - ruleStats["original"] = k; - ruleStats["byte_count"] = v; - ruleStats["category"] = params.stats[Long.parseLong(parts[0])]; - ruleStats["rule_number"] = Long.parseLong(parts[1]); + if (k.startsWith(str) && k.indexOf(":") > str.length()) { + ruleKeys.add(k); + def parts = k.substring(str.length()).splitOnToken(":"); + if (parts.length == 2 && isNumeric(v) && isNumeric(parts[1]) && parts[0].length() == 1 && isNumeric(parts[0])) { + int category = Integer.parseInt(parts[0]); + if (category < params.stats.size()) { + def item = [:]; + item["original"] = k; + item["byte_count"] = Long.parseLong(v); + item["category"] = params.stats[category]; + item["rule_number"] = Long.parseLong(parts[1]); + ruleStats.add(item); + } + } } - + return true; }); + for (k in ruleKeys) { + ctx.stormshield.remove(k); + } + if (ruleStats.isEmpty()) { return; } - for (entry in ruleStats.entrySet()) { - ruleStats[entry.getKey()].sort((a, b) -> a["original"].compareTo(b["original"])); - } + ruleStats.sort((a, b) -> a["original"].compareTo(b["original"])); if (!ctx.stormshield.containsKey("metadata")) { ctx.stormshield.metadata = [:]; } ctx.stormshield.metadata.rule_stats = ruleStats; - for (entry in ruleStats.entrySet()) { - ctx.stormshield.remove(entry.getValue()["original"]); - } on_failure: - append: field: error.message diff --git a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 21e0487bae3..74bc44b2661 100644 --- a/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/stormshield/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,5 @@ --- -description: Pipeline for processing sample logs +description: Pipeline for processing Stormshield SNS logs processors: - set: tag: set_ecs_version_f5923549 @@ -14,6 +14,10 @@ processors: tag: set_observer_vendor_ccce1c0c field: observer.vendor value: Stormshield + - set: + tag: set_observer_product + field: observer.product + value: SNS # # Extract the key=value pairs into nested objects @@ -139,6 +143,27 @@ processors: copy_from: stormshield.id if: ctx.stormshield?.id != null + - set: + tag: set_observer_ingress_interface_id + field: observer.ingress.interface.id + copy_from: stormshield.srcif + ignore_empty_value: true + - set: + tag: set_observer_ingress_interface_name + field: observer.ingress.interface.name + copy_from: stormshield.srcifname + ignore_empty_value: true + - set: + tag: set_observer_egress_interface_id + field: observer.egress.interface.id + copy_from: stormshield.dstif + ignore_empty_value: true + - set: + tag: set_observer_egress_interface_name + field: observer.egress.interface.name + copy_from: stormshield.dstifname + ignore_empty_value: true + - convert: tag: convert_stormshield_modsrc_to_source_nat_ip_cf7c07ec field: stormshield.modsrc @@ -222,7 +247,7 @@ processors: properties: - asn - organization_name - ignore_missing: true + if: ctx.destination?.ip != null - rename: tag: rename_destination_as_asn_to_destination_as_number_3b459fcd field: destination.as.asn @@ -246,7 +271,7 @@ processors: properties: - asn - organization_name - ignore_missing: true + if: ctx.source?.ip != null - rename: tag: rename_source_as_asn_to_source_as_number_a917047d field: source.as.asn @@ -295,6 +320,25 @@ processors: type: long ignore_missing: true + - convert: + tag: convert_stormshield_rcvd_to_destination_bytes + field: stormshield.rcvd + target_field: destination.bytes + type: long + ignore_missing: true + + - script: + tag: script_sum_network_bytes + lang: painless + description: Sum source and destination bytes into network.bytes. + if: ctx.source?.bytes != null && ctx.destination?.bytes != null + ignore_failure: true + source: >- + if (ctx.network == null) { + ctx.network = [:]; + } + ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes; + - rename: tag: rename_stormshield_dstname_to_destination_domain_675a68da field: stormshield.dstname @@ -446,6 +490,100 @@ processors: } + # Promote fields raised by the intrusion prevention engine before they are + # moved under stormshield.metadata. + - set: + tag: set_event_code_from_alarmid + field: event.code + copy_from: stormshield.alarmid + ignore_empty_value: true + - convert: + tag: convert_stormshield_risk_to_event_risk_score + field: stormshield.risk + target_field: event.risk_score + type: float + ignore_missing: true + on_failure: + - remove: + tag: remove_event_risk_score + field: event.risk_score + ignore_missing: true + # The pri field of alarm logs carries the alarm level (1 = major, 4 = minor), + # unlike other log families where it is a syslog-like severity hardcoded to 5. + - convert: + tag: convert_alarm_pri_to_event_severity + field: stormshield.pri + target_field: event.severity + type: long + if: ctx.stormshield?.logtype == 'alarm' && ctx.stormshield?.pri != null + ignore_failure: true + + # Promote HTTP proxy fields. + - set: + tag: set_url_original_from_arg + field: url.original + copy_from: stormshield.arg + ignore_empty_value: true + if: ctx.stormshield?.logtype == 'web' && ctx.stormshield?.arg != null + - set: + tag: set_url_domain_from_destination_domain + field: url.domain + copy_from: destination.domain + if: ctx.stormshield?.logtype == 'web' && ctx.destination?.domain != null + # On web logs, op is the HTTP method and result the HTTP server return code; + # on other families (ftp, plugin) they carry protocol-specific codes and are + # not promoted. Like the other promotions, these are copies: the vendor + # fields remain available under stormshield.metadata. + - set: + tag: set_http_request_method_from_op + field: http.request.method + copy_from: stormshield.op + ignore_empty_value: true + if: ctx.stormshield?.logtype == 'web' && ctx.stormshield?.op != null + - convert: + tag: convert_web_result_to_http_response_status_code + field: stormshield.result + target_field: http.response.status_code + type: long + if: ctx.stormshield?.logtype == 'web' && ctx.stormshield?.result != null && ctx.stormshield.result != '' + ignore_failure: true + + - append: + tag: append_related_hosts_srcname + field: related.hosts + value: "{{{stormshield.srcname}}}" + if: ctx.stormshield?.srcname != null && ctx.stormshield.srcname != '' + allow_duplicates: false + + # Promote identity and process fields. + - set: + tag: set_user_domain_from_domain + field: user.domain + copy_from: stormshield.domain + ignore_empty_value: true + if: ctx.stormshield?.domain != null + - set: + tag: set_user_group_name_from_usergroup + field: user.group.name + copy_from: stormshield.usergroup + ignore_empty_value: true + if: ctx.stormshield?.usergroup != null + # The usergroup field carries comma-separated values on SNS 5.x. + - split: + tag: split_user_group_name + field: user.group.name + separator: "," + if: ctx.user?.group?.name != null + # On pvm logs, service is the vulnerable product detected on a scanned host, + # not a module of the appliance, so the copy is restricted to the families + # where the field names the module that executed an action. + - set: + tag: set_process_name_from_service + field: process.name + copy_from: stormshield.service + ignore_empty_value: true + if: ctx.stormshield?.service != null && ['system', 'sandboxing', 'routing'].contains(ctx.stormshield?.logtype) + - script: tag: script_move_things lang: painless @@ -453,7 +591,9 @@ processors: params: names: - Pvm + - UI - address + - agentid - alarmid - arg - auth @@ -463,30 +603,83 @@ processors: - authsslvpn - authtotp - authwebadmin + - cat_site + - cipclassid + - cipservicecode - class + - classification + - clientappid - confid + - contentpolicy + - cookie_i + - cookie_r + - datechange + - domain - dstcontinent - dstcountry + - dsthostrep + - dstiprep - dstportname - error + - error_class + - error_code + - etherproto + - filename + - filetype + - format + - groupid + - icmpcode + - icmptype - id + - ikev + - localnet - mem + - method - modsrc - modsrcport - op + - peername + - phase + - pktdump + - pktdumplen + - pktlen - pri - rcvd + - remoteid + - remotenet + - repeat + - requestmode + - responsemode - result + - risk + - ruletype + - sandboxing + - sandboxinglevel - security + - sensible - sent + - serverappid - sessionid + - side - slotlevel - slotname + - spamlevel + - spi_in + - spi_out - srccontinent - srccountry + - srchostrep + - srciprep - srcname - srcportname + - target + - totp + - unit_id + - unitid + - urlruleid + - usergroup - version + - virus source: >- if (!ctx.stormshield.containsKey("metadata")) { ctx.stormshield.metadata = [:]; @@ -512,6 +705,94 @@ processors: type: long ignore_missing: true + # ------------------------------------------------------------ + # ECS categorization + - remove: + tag: remove_empty_event_action + description: An empty action field means the traffic matched a rule set to Log. + field: event.action + if: ctx.event?.action != null && ctx.event.action == '' + + - network_direction: + tag: network_direction + internal_networks: + - private + if: ctx.source?.ip != null && ctx.destination?.ip != null + ignore_failure: true + + - script: + tag: script_ecs_categorization + lang: painless + description: Set the ECS categorization fields from the log family, the rule action and the error code. + if: ctx.error == null + params: + logtypes: + alarm: { kind: alert, category: [intrusion_detection, network], type: [info] } + auth: { kind: event, category: [authentication], type: [start] } + authstat: { kind: metric, category: [authentication], type: [info] } + connection: { kind: event, category: [network, session], type: [connection, end] } + count: { kind: metric, category: [network], type: [info] } + date: { kind: event, category: [host], type: [change] } + dmrouting: { kind: event, category: [network, host], type: [change] } + filter: { kind: event, category: [network], type: [connection] } + filterstat: { kind: metric, category: [network], type: [info] } + ftp: { kind: event, category: [network], type: [info] } + ipsecstat: { kind: metric, category: [network], type: [info] } + monitor: { kind: metric, category: [host], type: [info] } + plugin: { kind: event, category: [network], type: [protocol] } + pop3: { kind: event, category: [email, network], type: [info] } + pvm: { kind: event, category: [vulnerability], type: [info] } + restapi: { kind: event, category: [web, configuration], type: [access] } + routerstat: { kind: metric, category: [network], type: [info] } + routing: { kind: event, category: [network, host], type: [change] } + sandboxing: { kind: event, category: [network], type: [info] } + server: { kind: event, category: [configuration], type: [access] } + smtp: { kind: event, category: [email, network], type: [info] } + ssl: { kind: event, category: [network], type: [connection] } + system: { kind: event, category: [host], type: [info] } + vpn: { kind: event, category: [network], type: [info] } + web: { kind: event, category: [web, network], type: [access] } + xvpn: { kind: event, category: [network, session], type: [connection] } + action_types: + pass: allowed + block: denied + action_logtypes: + - alarm + - connection + - filter + - ftp + - plugin + - pop3 + - smtp + - ssl + - web + outcome_logtypes: + - auth + - server + - xvpn + source: >- + def logtype = ctx.stormshield?.logtype; + def entry = params.logtypes[logtype]; + if (entry == null) { + entry = ['kind': 'event', 'category': ['network'], 'type': ['info']]; + } + if (ctx.event == null) { + ctx.event = [:]; + } + ctx.event.kind = entry.kind; + ctx.event.category = new ArrayList(entry.category); + ctx.event.type = new ArrayList(entry.type); + if (params.action_logtypes.contains(logtype) && ctx.event.action instanceof String) { + def mapped = params.action_types[ctx.event.action.toLowerCase()]; + if (mapped != null && !ctx.event.type.contains(mapped)) { + ctx.event.type.add(mapped); + } + } + def err = ctx.stormshield?.metadata?.error; + if (params.outcome_logtypes.contains(logtype) && err instanceof String && err != '') { + ctx.event.outcome = err == '0' ? 'success' : 'failure'; + } + # ------------------------------------------------------------ # Add the 'related' fields - append: @@ -549,6 +830,13 @@ processors: if: ctx.user?.name != null allow_duplicates: false + - append: + tag: append_related_hosts_destination_domain + field: related.hosts + value: "{{{destination.domain}}}" + if: ctx.destination?.domain != null + allow_duplicates: false + # ------------------------------------------------------------ # Cleanup - remove: diff --git a/packages/stormshield/data_stream/log/fields/ecs.yml b/packages/stormshield/data_stream/log/fields/ecs.yml index f979a751479..0d7f2bfc648 100644 --- a/packages/stormshield/data_stream/log/fields/ecs.yml +++ b/packages/stormshield/data_stream/log/fields/ecs.yml @@ -104,11 +104,55 @@ name: rule.name - external: ecs name: source.bytes +- external: ecs + name: destination.bytes +- external: ecs + name: network.bytes +- external: ecs + name: network.direction +- external: ecs + name: observer.ingress.interface.id +- external: ecs + name: observer.ingress.interface.name +- external: ecs + name: observer.egress.interface.id +- external: ecs + name: observer.egress.interface.name +- external: ecs + name: event.action - external: ecs name: event.duration +- external: ecs + name: event.kind +- external: ecs + name: event.category +- external: ecs + name: event.type +- external: ecs + name: event.code +- external: ecs + name: event.risk_score +- external: ecs + name: event.severity +- external: ecs + name: url.original +- external: ecs + name: url.domain - external: ecs name: related.ip - external: ecs name: related.user +- external: ecs + name: related.hosts - external: ecs name: user.name +- external: ecs + name: user.domain +- external: ecs + name: user.group.name +- external: ecs + name: event.outcome +- external: ecs + name: http.request.method +- external: ecs + name: http.response.status_code diff --git a/packages/stormshield/data_stream/log/fields/fields.yml b/packages/stormshield/data_stream/log/fields/fields.yml index 0fc537c57e8..4b5577319ae 100644 --- a/packages/stormshield/data_stream/log/fields/fields.yml +++ b/packages/stormshield/data_stream/log/fields/fields.yml @@ -22,21 +22,9 @@ - name: dstifname type: keyword description: 'Name of the object representing the traffics destination interface. String of characters in UTF-8 format. Example: dmz1 Available from: SNS v1.0.0.' - - name: duration - type: keyword - description: 'Duration of the connection in seconds. Decimal format. Example: "173.15"' - name: fw type: keyword description: 'firewall''s ID This is the name entered by the administrator or, by default, its serial number. String of characters in UTF-8 format. Example: firewall_name or V50XXXXXXXXXXXX Available from: SNS v1.0.0.' - - name: msg - type: keyword - description: 'Text message explaining the alarm. String of characters in UTF-8 format. Example: Port probe' - - name: origdst - type: keyword - description: 'Original IP address of the destination host (before translation or the application of a virtual connection). Decimal format. Example: 192.168.0.1 Available from: SNS v1.0.0.' - - name: origdstport - type: keyword - description: 'Original port number of the destination TCP/UDP port (before translation or the application of a virtual connection). Example: "80" Available from: SNS v1.0.0.' - name: service type: keyword description: 'Service (product with a dedicated port) on which the vulnerability was detected. String of characters in UTF-8 format. Example: OpenSSH_5.4' @@ -51,10 +39,7 @@ description: 'Local time at the beginning of the logged event (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0.' - name: system type: keyword - description: Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, etc). Decimal format representing a percentage. + description: Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, and so on). Decimal format representing a percentage. - name: time type: keyword description: 'Local time at which the log was recorded in the log file (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0.' - - name: tz - type: keyword - description: 'Time difference between the Firewalls time and GMT. This depends on the time zone used. String in +HHMM or -HHMM format. Available from: SNS v1.0.0.' diff --git a/packages/stormshield/data_stream/log/sample_event.json b/packages/stormshield/data_stream/log/sample_event.json index f368f0770ea..d0f9951be78 100644 --- a/packages/stormshield/data_stream/log/sample_event.json +++ b/packages/stormshield/data_stream/log/sample_event.json @@ -1,39 +1,46 @@ { "@timestamp": "2024-03-08T10:14:08.000Z", "agent": { - "ephemeral_id": "fbc0ca2c-7300-45ce-84b1-6ece2bc46905", - "id": "e0b60804-99ad-435e-865c-35384901d186", - "name": "elastic-agent-45518", + "ephemeral_id": "19c5155e-5f61-4dc1-b23c-cd84e946b455", + "id": "63ff8a64-ec88-4856-ba1c-8653054b4358", + "name": "elastic-agent-17632", "type": "filebeat", - "version": "8.14.1" + "version": "9.4.3" }, "data_stream": { "dataset": "stormshield.log", - "namespace": "65295", + "namespace": "52256", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "e0b60804-99ad-435e-865c-35384901d186", + "id": "63ff8a64-ec88-4856-ba1c-8653054b4358", "snapshot": false, - "version": "8.14.1" + "version": "9.4.3" }, "event": { "agent_id_status": "verified", + "category": [ + "configuration" + ], "dataset": "stormshield.log", - "ingested": "2024-09-18T14:01:36Z", + "ingested": "2026-07-08T10:05:22Z", + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"PKI SEARCH scope=local type=ca\" logtype=\"server\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "input": { "type": "tcp" }, "log": { "source": { - "address": "172.27.0.3:40024" + "address": "172.21.0.3:49430" }, "syslog": { "appname": "serverd", @@ -80,4 +87,4 @@ "user": { "name": "admin" } -} \ No newline at end of file +} diff --git a/packages/stormshield/docs/README.md b/packages/stormshield/docs/README.md index b6c07850c5b..7d2b437c6f3 100644 --- a/packages/stormshield/docs/README.md +++ b/packages/stormshield/docs/README.md @@ -9,7 +9,7 @@ The StormShield SNS integration for Elastic enables you to collect and analyze s This integration is compatible with the following third-party vendor systems: - Stormshield Network Security (SNS) firewalls running the unified firmware base. -- SNS v4.x, which is the primarily documented and tested version for these log formats. +- SNS 4.x and SNS 5.x, which share the same WELF key-value audit log format. ### How it works @@ -17,7 +17,7 @@ This integration collects logs from Stormshield SNS firewalls by receiving syslo ## What data does this integration collect? -The StormShield SNS integration collects a variety of security and system events from SNS instances. Each data stream provides specific insights into network activity: +The StormShield SNS integration collects a variety of security and system events from SNS instances into a single `log` data stream. The collected log families provide specific insights into network activity: - Firewall logs: These provide detailed records of filter and NAT policy decisions, including source and destination IP addresses, ports, and protocols. - Audit and administrative logs: These capture events related to administrative logins, configuration changes through `serverd`, and system-level operations. - Alarm logs: These contain security-specific alerts generated by the SNS Intrusion Prevention System (IPS) and detection engines. @@ -68,36 +68,40 @@ To configure Stormshield Network Security (SNS) to forward logs to the Elastic A 1. Log in to the Stormshield Network Security web administration interface. 2. Navigate to the **CONFIGURATION** tab. -3. Go to **NOTIFICATIONS > LOGS - SYSLOG - IPFIX**. +3. Go to **NOTIFICATIONS → LOGS - SYSLOG - IPFIX**. 4. In the **Syslog** section, make sure the service is enabled by switching the status to **ON**. 5. Select a **Profile** slot to edit (e.g., Profile 1). 6. In the **Syslog server** field, select or create a host object corresponding to the Elastic Agent host. 7. Enter the **Port** number matching your Elastic Agent configuration (e.g., `514` for UDP or `601` for TCP). 8. Select the **Protocol** (**UDP** or **TCP**) that matches your integration input. -9. Choose the **Format**: **RFC5424** is recommended for modern logging, though **Legacy** (BSD) is also supported. +9. Set the **Format** to **RFC5424**. The integration expects RFC5424 messages; the **Legacy** and **Legacy long** formats are not supported at this time. 10. In the **Advanced properties** section, enable the specific log families you want to send. Make sure **Filter Policy**, **Administration**, **System**, and **Alarms** are active. 11. Click **Apply** to save the syslog configuration. #### Enabling traffic logs for specific rules -1. Navigate to **Configuration > Security policy > Filter - NAT**. +1. Navigate to **Configuration → Security policy → Filter - NAT**. 2. Identify the security rules for which you want to collect logs. 3. Double-click a rule to open its properties. 4. Go to the **Action** menu or the General tab. 5. Set the **Log level** to **Standard (connection log)**. 6. Click **OK** and then click **Apply** at the top of the interface to deploy the policy change. +#### Collecting flow records over IPFIX (optional) + +SNS firewalls can also export network flow records over the IPFIX protocol, configured in the same **NOTIFICATIONS → LOGS - SYSLOG - IPFIX** module (default port `4739`). Flow records are not handled by this integration: to collect them, use the [NetFlow Records](https://www.elastic.co/docs/reference/integrations/netflow) integration, which supports IPFIX. Both integrations can run on the same Elastic Agent to combine audit logs with flow analytics. + #### Vendor resources -- [Stormshield SNS Syslog Configuration](https://documentation.stormshield.eu/SNS/v4/en/Content/User_Configuration_Manual_SNS_v4/Logs-syslog/Syslog_tab.htm) -- [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm) +- [Stormshield SNS Syslog Configuration](https://documentation.stormshield.eu/SNS/v5/en/Content/User_Configuration_Manual_SNS_v5/Logs-syslog/Syslog_tab.htm) +- [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v5/en/Content/Description_of_Audit_logs/Configure_logs.htm) - [FireMon - Stormshield Device Configuration Guide](https://docs.firemon.com/feature/Content/ADMINISTRATION/DEVICE/Devices/StormShield/Stormshield_Network_Security.htm?TocPath=Administration|Device|Devices|Choose+a+Device+to+Onboard|_____51) ### Set up steps in Kibana To set up the integration in Kibana, follow these steps: -1. In Kibana, navigate to **Management > Integrations**. +1. In Kibana, navigate to **Management → Integrations**. 2. Search for and select **Stormshield SNS**. 3. Click **Add Stormshield SNS**. 4. Configure the inputs based on your Stormshield SNS configuration. @@ -159,11 +163,11 @@ Perform the following actions on your Stormshield device to generate logs: #### 2. Check data in Kibana To verify the data in Kibana: -1. Navigate to **Analytics > Discover**. +1. Navigate to **Analytics → Discover**. 2. Select the `logs-*` data view. 3. Enter the following KQL filter in the search bar: `data_stream.dataset : "stormshield.log"` 4. Verify logs appear and expand an entry to confirm the presence of fields like `event.dataset`, `source.ip`, and `message`. -5. Navigate to **Analytics > Dashboards** and search for "Stormshield SNS" to view pre-built visualizations. +5. Navigate to **Analytics → Dashboards** and search for "Stormshield SNS" to view pre-built visualizations. ## Troubleshooting @@ -266,6 +270,42 @@ To collect logs via UDP, select **Collect logs via UDP** and configure the follo You'll find events from Stormshield SNS logs in the `log` data stream. This data stream includes logs of the following types: traffic, filter, protection, and system events. +##### ECS event categorization + +Each log family (identified by the `logtype` field) is mapped to the ECS categorization fields. Alarms raised by the intrusion prevention engine produce `event.kind: alert`. The periodic statistics families (`monitor`, `filterstat`, `count`, `routerstat`, `authstat`, `ipsecstat`) produce `event.kind: metric`, so health telemetry can be excluded from detection rule scopes with a single filter. All other families produce `event.kind: event`. + +| logtype | event.kind | event.category | event.type | +|---|---|---|---| +| alarm | alert | intrusion_detection, network | info | +| auth | event | authentication | start | +| authstat | metric | authentication | info | +| connection | event | network, session | connection, end | +| count, filterstat, ipsecstat, routerstat | metric | network | info | +| date | event | host | change | +| dmrouting, routing | event | network, host | change | +| filter | event | network | connection | +| ftp | event | network | info | +| monitor | metric | host | info | +| plugin | event | network | protocol | +| pop3, smtp | event | email, network | info | +| pvm | event | vulnerability | info | +| restapi | event | web, configuration | access | +| sandboxing | event | network | info | +| server | event | configuration | access | +| ssl | event | network | connection | +| system | event | host | info | +| vpn | event | network | info | +| web | event | web, network | access | +| xvpn | event | network, session | connection | + +For the families that carry a rule action, `event.type` additionally receives `allowed` when the action is `pass` and `denied` when the action is `block` (matched case-insensitively). An empty action field corresponds to a rule set to Log, and no modifier is added. Unknown log families fall back to `event.kind: event` with `event.category: network` and `event.type: info`. + +For the `auth`, `server` and `xvpn` families, `event.outcome` is derived from the vendor `error` field: `success` when the error code is `0`, `failure` otherwise. + +For alarm logs, `event.code` carries the Stormshield alarm identifier, `event.risk_score` the `risk` field (1-100), and `event.severity` the vendor alarm level from `pri`, where 1 is a major alarm and 4 a minor alarm. This scale is specific to the alarm family. In most other families, the appliance hardcodes the `pri` field to 5. + +`network.direction` is computed from the source and destination IP addresses, treating private (RFC 1918) address ranges as internal networks. + ##### `log` fields You'll find a list of all exported fields in the following table: @@ -281,6 +321,7 @@ You'll find a list of all exported fields in the following table: | destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | destination.as.organization.name | Organization name. | keyword | | destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.bytes | Bytes sent from the destination to the source. | long | | destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | destination.geo.city_name | City name. | keyword | | destination.geo.continent_name | Name of the continent. | keyword | @@ -296,7 +337,17 @@ You'll find a list of all exported fields in the following table: | destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | +| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | +| http.response.status_code | HTTP response status code. | long | | input.type | Type of input. | keyword | | log.source.address | Source address for the log. | keyword | | log.syslog.appname | The device or application that originated the Syslog message, if available. | keyword | @@ -308,15 +359,22 @@ You'll find a list of all exported fields in the following table: | log.syslog.severity.name | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`. | keyword | | log.syslog.version | The version of the Syslog protocol specification. Only applicable for RFC 5424 messages. | keyword | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | | network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | | network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | | network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | +| observer.egress.interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | +| observer.egress.interface.name | Interface name as reported by the system. | keyword | +| observer.ingress.interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | +| observer.ingress.interface.name | Interface name as reported by the system. | keyword | | observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | | observer.product | The product name of the observer. | keyword | | observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | | observer.vendor | Vendor name of the observer. | keyword | | process.name | Process name. Sometimes called program name or similar. | keyword | | process.name.text | Multi-field of `process.name`. | match_only_text | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | | rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | @@ -340,24 +398,24 @@ You'll find a list of all exported fields in the following table: | source.port | Port of the source. | long | | stormshield.dstif | Name of the destination interface. String of characters in UTF-8 format. Example: Ethernet 1 Available from: SNS v1.0.0. | keyword | | stormshield.dstifname | Name of the object representing the traffics destination interface. String of characters in UTF-8 format. Example: dmz1 Available from: SNS v1.0.0. | keyword | -| stormshield.duration | Duration of the connection in seconds. Decimal format. Example: "173.15" | keyword | | stormshield.fw | firewall's ID This is the name entered by the administrator or, by default, its serial number. String of characters in UTF-8 format. Example: firewall_name or V50XXXXXXXXXXXX Available from: SNS v1.0.0. | keyword | | stormshield.in_bytes | Count of bytes coming into the firewall | long | | stormshield.logtype | The specific type of log this is from. | keyword | | stormshield.metadata | Flattened metadata | flattened | -| stormshield.msg | Text message explaining the alarm. String of characters in UTF-8 format. Example: Port probe | keyword | -| stormshield.origdst | Original IP address of the destination host (before translation or the application of a virtual connection). Decimal format. Example: 192.168.0.1 Available from: SNS v1.0.0. | keyword | -| stormshield.origdstport | Original port number of the destination TCP/UDP port (before translation or the application of a virtual connection). Example: "80" Available from: SNS v1.0.0. | keyword | | stormshield.out_bytes | Count of bytes leaving the firewall | long | | stormshield.ports | The network ports found on the device | keyword | | stormshield.service | Service (product with a dedicated port) on which the vulnerability was detected. String of characters in UTF-8 format. Example: OpenSSH_5.4 | keyword | | stormshield.srcif | Internal name of the interface at the source of the traffic. String of characters in UTF-8 format. Example: Ethernet0 Available from: SNS v1.0.0. | keyword | | stormshield.srcifname | Name of the object representing the interface at the source of the traffic. String of characters in UTF-8 format. Example: out Available from: SNS v1.0.0. | keyword | | stormshield.startime | Local time at the beginning of the logged event (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0. | keyword | -| stormshield.system | Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, etc). Decimal format representing a percentage. | keyword | +| stormshield.system | Indicator of the Firewalls system status. This value is used by the fleet management tool (Stormshield Network Unified Manager) to provide information on the system status (available RAM, CPU use, bandwidth, interfaces, fullness of audit logs, and so on). Decimal format representing a percentage. | keyword | | stormshield.time | Local time at which the log was recorded in the log file (time configured on the Firewall). String in YYYY-MM-DD HH:MM:SS format. Available from: SNS v1.0.0. | keyword | -| stormshield.tz | Time difference between the Firewalls time and GMT. This depends on the time zone used. String in +HHMM or -HHMM format. Available from: SNS v1.0.0. | keyword | | tags | List of keywords used to tag each event. | keyword | +| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.group.name | Name of the group. | keyword | | user.name | Short name or login of the user. | keyword | | user.name.text | Multi-field of `user.name`. | match_only_text | @@ -372,39 +430,46 @@ An example event for `log` looks as following: { "@timestamp": "2024-03-08T10:14:08.000Z", "agent": { - "ephemeral_id": "fbc0ca2c-7300-45ce-84b1-6ece2bc46905", - "id": "e0b60804-99ad-435e-865c-35384901d186", - "name": "elastic-agent-45518", + "ephemeral_id": "19c5155e-5f61-4dc1-b23c-cd84e946b455", + "id": "63ff8a64-ec88-4856-ba1c-8653054b4358", + "name": "elastic-agent-17632", "type": "filebeat", - "version": "8.14.1" + "version": "9.4.3" }, "data_stream": { "dataset": "stormshield.log", - "namespace": "65295", + "namespace": "52256", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "e0b60804-99ad-435e-865c-35384901d186", + "id": "63ff8a64-ec88-4856-ba1c-8653054b4358", "snapshot": false, - "version": "8.14.1" + "version": "9.4.3" }, "event": { "agent_id_status": "verified", + "category": [ + "configuration" + ], "dataset": "stormshield.log", - "ingested": "2024-09-18T14:01:36Z", + "ingested": "2026-07-08T10:05:22Z", + "kind": "event", "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"PKI SEARCH scope=local type=ca\" logtype=\"server\"", "start": "2024-03-08T10:14:08.000Z", - "timezone": "+00:00" + "timezone": "+00:00", + "type": [ + "access" + ] }, "input": { "type": "tcp" }, "log": { "source": { - "address": "172.27.0.3:40024" + "address": "172.21.0.3:49430" }, "syslog": { "appname": "serverd", @@ -457,5 +522,5 @@ An example event for `log` looks as following: ### Vendor documentation links You'll find additional details about Stormshield SNS logs in these official resources: -* [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm) +* [Stormshield SNS Log Configuration Documentation](https://documentation.stormshield.eu/SNS/v5/en/Content/Description_of_Audit_logs/Configure_logs.htm) * [Stormshield Official Website](https://www.stormshield.com) diff --git a/packages/stormshield/docs/knowledge_base/service_info.md b/packages/stormshield/docs/knowledge_base/service_info.md index b86b2016170..0cc8737fe89 100644 --- a/packages/stormshield/docs/knowledge_base/service_info.md +++ b/packages/stormshield/docs/knowledge_base/service_info.md @@ -23,7 +23,7 @@ The **Stormshield SNS logs** integration collects a variety of security and syst This integration is compatible with the following third-party vendor systems: - **Stormshield Network Security (SNS)** firewalls running the unified firmware base. -- **SNS v4.x** is the primarily documented and tested version for these log formats. +- **SNS 4.x and SNS 5.x**, which share the same WELF key-value audit log format. ## Scaling and Performance @@ -57,19 +57,19 @@ To configure Stormshield Network Security (SNS) to forward logs to the Elastic A 1. Log in to the Stormshield Network Security web administration interface. 2. Navigate to the **CONFIGURATION** tab on the left sidebar. -3. Go to **NOTIFICATIONS > LOGS - SYSLOG - IPFIX**. +3. Go to **NOTIFICATIONS → LOGS - SYSLOG - IPFIX**. 4. In the **Syslog** section, ensure the service is enabled by switching the status to **ON**. 5. Select a **Profile** slot to edit (e.g., Profile 1). 6. In the **Syslog server** field, select or create a host object corresponding to the Elastic Agent host. 7. Enter the **Port** number matching your Elastic Agent configuration (e.g., `514` for UDP or `601` for TCP). 8. Select the **Protocol** (**UDP** or **TCP**) that matches your integration input. -9. Choose the **Format**: **RFC5424** is recommended for modern logging, though **Legacy** (BSD) is also supported. +9. Set the **Format** to **RFC5424**. The integration expects RFC5424 messages; the **Legacy** and **Legacy long** formats are not supported at this time. 10. In the **Advanced properties** section, enable the specific log families you wish to send. Ensure **Filter Policy**, **Administration**, **System**, and **Alarms** are active. 11. Click **Apply** to save the syslog configuration. ### Enabling Traffic Logs for Specific Rules: -1. Navigate to **Configuration > Security policy > Filter - NAT**. +1. Navigate to **Configuration → Security policy → Filter - NAT**. 2. Identify the security rules for which you want to collect logs. 3. Double-click a rule to open its properties. 4. Go to the **Action** menu or the General tab. @@ -84,7 +84,7 @@ To configure Stormshield Network Security (SNS) to forward logs to the Elastic A ## Kibana set up steps -1. In Kibana, navigate to **Management > Integrations**. +1. In Kibana, navigate to **Management → Integrations**. 2. Search for and select **StormShield SNS**. 3. Click **Add StormShield SNS**. 4. Configure the inputs based on your SNS configuration: @@ -122,15 +122,15 @@ After configuration is complete, verify that data is flowing correctly. - **Trigger Alarm:** If a test environment is available, attempt a restricted access pattern (such as an Nmap scan) to trigger an intrusion detection alarm. ### 2. Check Data in Kibana: -1. Navigate to **Analytics > Discover**. +1. Navigate to **Analytics → Discover**. 2. Select the `logs-*` data view. 3. Enter the KQL filter: `data_stream.dataset : "stormshield.log"` 4. Verify logs appear. Expand a log entry and confirm these fields: - `event.dataset` (should be `stormshield.log`) - - `source.ip` and/or `destination.ip` - - `event.action` or `event.outcome` + - `source.ip`, `destination.ip`, or both + - `event.action` - `message` (the raw log payload) -5. Navigate to **Analytics > Dashboards** and search for "StormShield SNS" to view pre-built visualizations. +5. Navigate to **Analytics → Dashboards** and search for "StormShield SNS" to view pre-built visualizations. # Troubleshooting diff --git a/packages/stormshield/img/dashboard.png b/packages/stormshield/img/dashboard.png deleted file mode 100644 index c424586c1d0..00000000000 Binary files a/packages/stormshield/img/dashboard.png and /dev/null differ diff --git a/packages/stormshield/img/stormshield-sns-alarms.png b/packages/stormshield/img/stormshield-sns-alarms.png new file mode 100644 index 00000000000..8114b2dec83 Binary files /dev/null and b/packages/stormshield/img/stormshield-sns-alarms.png differ diff --git a/packages/stormshield/img/stormshield-sns-network-traffic.png b/packages/stormshield/img/stormshield-sns-network-traffic.png new file mode 100644 index 00000000000..cd949676a8c Binary files /dev/null and b/packages/stormshield/img/stormshield-sns-network-traffic.png differ diff --git a/packages/stormshield/img/stormshield-sns-overview.png b/packages/stormshield/img/stormshield-sns-overview.png new file mode 100644 index 00000000000..6e0179e1eb8 Binary files /dev/null and b/packages/stormshield/img/stormshield-sns-overview.png differ diff --git a/packages/stormshield/img/stormshield-sns-users-vpn.png b/packages/stormshield/img/stormshield-sns-users-vpn.png new file mode 100644 index 00000000000..1646d2c8eee Binary files /dev/null and b/packages/stormshield/img/stormshield-sns-users-vpn.png differ diff --git a/packages/stormshield/img/stormshield-sns-web-activity.png b/packages/stormshield/img/stormshield-sns-web-activity.png new file mode 100644 index 00000000000..d942bc33483 Binary files /dev/null and b/packages/stormshield/img/stormshield-sns-web-activity.png differ diff --git a/packages/stormshield/kibana/dashboard/stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002.json b/packages/stormshield/kibana/dashboard/stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002.json new file mode 100644 index 00000000000..d6f114b18ad --- /dev/null +++ b/packages/stormshield/kibana/dashboard/stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002.json @@ -0,0 +1,1060 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"440785c6-61cc-4a85-a129-e4aa5f32590f\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"440785c6-61cc-4a85-a129-e4aa5f32590f\",\"fieldName\":\"stormshield.fw\",\"title\":\"Firewall Id\",\"grow\":false,\"width\":\"small\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"0e8afad9-83ae-43ac-8f0e-aac581300173\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0e8afad9-83ae-43ac-8f0e-aac581300173\",\"fieldName\":\"event.action\",\"title\":\"event.action\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{},\"selectedOptions\":[],\"dataViewId\":\"logs-*\"}},\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\",\"fieldName\":\"log.syslog.facility.name\",\"title\":\"Syslog facility\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"fa254ad2-d372-4df0-91f1-e277f993a09d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fa254ad2-d372-4df0-91f1-e277f993a09d\",\"fieldName\":\"log.syslog.severity.name\",\"title\":\"Syslog severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\",\"fieldName\":\"user.name\",\"title\":\"User\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}}}" + }, + "description": "Alarms raised by the intrusion prevention engine of Stormshield SNS firewalls.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "stormshield.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "stormshield.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "stormshield.logtype", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "stormshield.logtype", + "negate": false, + "params": { + "query": "alarm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "stormshield.logtype": "alarm" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-33a48b60-d148-58ee-923b-3159d9f3d942", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "33a48b60-d148-58ee-923b-3159d9f3d942": { + "columnOrder": [ + "f7210768-ca8b-5361-9a22-2db31997589d", + "fa27ea62-35f0-5454-893c-93bf97353d4a" + ], + "columns": { + "f7210768-ca8b-5361-9a22-2db31997589d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "fa27ea62-35f0-5454-893c-93bf97353d4a": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "fa27ea62-35f0-5454-893c-93bf97353d4a" + ], + "layerId": "33a48b60-d148-58ee-923b-3159d9f3d942", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "f7210768-ca8b-5361-9a22-2db31997589d" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "dbd36ee2-ce51-5c01-a7f8-20ac061ff0ed", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "dbd36ee2-ce51-5c01-a7f8-20ac061ff0ed", + "title": "Alarms over time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0dc1a2d0-031c-54cc-bb3d-511946e4dc07", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0dc1a2d0-031c-54cc-bb3d-511946e4dc07": { + "columnOrder": [ + "5f4b706b-b9e3-5fc7-b64c-c6a24dcb1073" + ], + "columns": { + "5f4b706b-b9e3-5fc7-b64c-c6a24dcb1073": { + "dataType": "number", + "isBucketed": false, + "label": "Alarms", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___", + "customLabel": true + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "0dc1a2d0-031c-54cc-bb3d-511946e4dc07", + "layerType": "data", + "metricAccessor": "5f4b706b-b9e3-5fc7-b64c-c6a24dcb1073" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} + }, + "gridData": { + "h": 9, + "i": "6b282572-fec2-5663-b8f6-5574cf407f28", + "w": 8, + "x": 24, + "y": 0 + }, + "panelIndex": "6b282572-fec2-5663-b8f6-5574cf407f28", + "type": "lens", + "title": "Alarm count" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ab83a13d-87c9-5f49-a26d-c237bc57dc4d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "ab83a13d-87c9-5f49-a26d-c237bc57dc4d": { + "columnOrder": [ + "8ea7fbe1-bf06-5ded-93ad-75477f36a6d1", + "ce655896-0b85-5fee-905a-fc799f08fc01" + ], + "columns": { + "ce655896-0b85-5fee-905a-fc799f08fc01": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8ea7fbe1-bf06-5ded-93ad-75477f36a6d1": { + "dataType": "number", + "isBucketed": true, + "label": "Top 4 values of event.severity", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ce655896-0b85-5fee-905a-fc799f08fc01", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 4 + }, + "scale": "ordinal", + "sourceField": "event.severity" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "ab83a13d-87c9-5f49-a26d-c237bc57dc4d", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "ce655896-0b85-5fee-905a-fc799f08fc01" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8ea7fbe1-bf06-5ded-93ad-75477f36a6d1" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "b9ba912b-0fda-5235-b94e-c8ea532091e3", + "w": 16, + "x": 32, + "y": 0 + }, + "panelIndex": "b9ba912b-0fda-5235-b94e-c8ea532091e3", + "title": "Alarm severity (1 = major, 4 = minor)", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b76aee0c-46c5-556f-8ba8-4b99965cf0f2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "b76aee0c-46c5-556f-8ba8-4b99965cf0f2": { + "columnOrder": [ + "8f39f632-def2-5159-98ec-ef7807dc1a32", + "b6c55eb3-6e0f-5056-8c16-c9200e6523f4" + ], + "columns": { + "b6c55eb3-6e0f-5056-8c16-c9200e6523f4": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8f39f632-def2-5159-98ec-ef7807dc1a32": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of event.action", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b6c55eb3-6e0f-5056-8c16-c9200e6523f4", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "b76aee0c-46c5-556f-8ba8-4b99965cf0f2", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "b6c55eb3-6e0f-5056-8c16-c9200e6523f4" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8f39f632-def2-5159-98ec-ef7807dc1a32" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "5daca082-ec6c-5528-ba45-b16eed39c5d5", + "w": 12, + "x": 0, + "y": 9 + }, + "panelIndex": "5daca082-ec6c-5528-ba45-b16eed39c5d5", + "title": "Alarm actions", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fb51d00c-6e2a-514f-a775-3e64e2c37195", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "fb51d00c-6e2a-514f-a775-3e64e2c37195": { + "columnOrder": [ + "f4c67c7f-b5e7-5f96-9909-df2990164ac8", + "2a5948c7-c27b-5fb5-af9b-fe9469a0e572" + ], + "columns": { + "2a5948c7-c27b-5fb5-af9b-fe9469a0e572": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f4c67c7f-b5e7-5f96-9909-df2990164ac8": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of event.code", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2a5948c7-c27b-5fb5-af9b-fe9469a0e572", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.code" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "fb51d00c-6e2a-514f-a775-3e64e2c37195", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "2a5948c7-c27b-5fb5-af9b-fe9469a0e572" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "f4c67c7f-b5e7-5f96-9909-df2990164ac8" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "334053ec-d73a-51e1-9cd1-481487b181b5", + "w": 12, + "x": 12, + "y": 9 + }, + "panelIndex": "334053ec-d73a-51e1-9cd1-481487b181b5", + "title": "Top alarm IDs", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-181889fe-90e3-5c30-b75f-f0411a0ac138", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "181889fe-90e3-5c30-b75f-f0411a0ac138": { + "columnOrder": [ + "8860558d-c7b7-5cc6-9bc4-b0cf3012022f", + "f138ffd2-631c-5ba3-ab35-a276613937ca" + ], + "columns": { + "f138ffd2-631c-5ba3-ab35-a276613937ca": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8860558d-c7b7-5cc6-9bc4-b0cf3012022f": { + "dataType": "ip", + "isBucketed": true, + "label": "Top 10 values of source.ip", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f138ffd2-631c-5ba3-ab35-a276613937ca", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "181889fe-90e3-5c30-b75f-f0411a0ac138", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "f138ffd2-631c-5ba3-ab35-a276613937ca" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8860558d-c7b7-5cc6-9bc4-b0cf3012022f" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "d0bffc64-50b7-5de6-8f0f-ed50cda30796", + "w": 12, + "x": 24, + "y": 9 + }, + "panelIndex": "d0bffc64-50b7-5de6-8f0f-ed50cda30796", + "title": "Top source addresses", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cb829b24-4bc5-5934-bdd4-38b00af9d1e1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "cb829b24-4bc5-5934-bdd4-38b00af9d1e1": { + "columnOrder": [ + "7e9246e0-4f9f-5ae7-b735-90a23f9b057e", + "78b1b4ce-310d-5476-990e-14fa234e48d6" + ], + "columns": { + "78b1b4ce-310d-5476-990e-14fa234e48d6": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7e9246e0-4f9f-5ae7-b735-90a23f9b057e": { + "dataType": "number", + "isBucketed": true, + "label": "Top 10 values of destination.port", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "78b1b4ce-310d-5476-990e-14fa234e48d6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.port" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "cb829b24-4bc5-5934-bdd4-38b00af9d1e1", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "78b1b4ce-310d-5476-990e-14fa234e48d6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7e9246e0-4f9f-5ae7-b735-90a23f9b057e" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "82efd6ff-47ab-5957-92b3-ff013ad6fd2d", + "w": 12, + "x": 36, + "y": 9 + }, + "panelIndex": "82efd6ff-47ab-5957-92b3-ff013ad6fd2d", + "title": "Top destination ports", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7fb571c8-8876-58ec-a1ae-00c5da9c1bec", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "7fb571c8-8876-58ec-a1ae-00c5da9c1bec": { + "columnOrder": [ + "31f833eb-ecf9-58a7-a956-51e819453761", + "6a581dde-0878-5fbf-bf99-81dbdd5328d9" + ], + "columns": { + "6a581dde-0878-5fbf-bf99-81dbdd5328d9": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "31f833eb-ecf9-58a7-a956-51e819453761": { + "dataType": "string", + "isBucketed": true, + "label": "Top 12 values of observer.name", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6a581dde-0878-5fbf-bf99-81dbdd5328d9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 12 + }, + "scale": "ordinal", + "sourceField": "observer.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "7fb571c8-8876-58ec-a1ae-00c5da9c1bec", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "6a581dde-0878-5fbf-bf99-81dbdd5328d9" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "31f833eb-ecf9-58a7-a956-51e819453761" + ] + } + ], + "shape": "treemap" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "ac219908-ca85-5b5a-88f9-1f96a77ce979", + "w": 48, + "x": 0, + "y": 18 + }, + "panelIndex": "ac219908-ca85-5b5a-88f9-1f96a77ce979", + "title": "Alarms by firewall", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Stormshield SNS] Alarms (IPS)", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "id": "stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dbd36ee2-ce51-5c01-a7f8-20ac061ff0ed:indexpattern-datasource-layer-33a48b60-d148-58ee-923b-3159d9f3d942", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6b282572-fec2-5663-b8f6-5574cf407f28:indexpattern-datasource-layer-0dc1a2d0-031c-54cc-bb3d-511946e4dc07", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b9ba912b-0fda-5235-b94e-c8ea532091e3:indexpattern-datasource-layer-ab83a13d-87c9-5f49-a26d-c237bc57dc4d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5daca082-ec6c-5528-ba45-b16eed39c5d5:indexpattern-datasource-layer-b76aee0c-46c5-556f-8ba8-4b99965cf0f2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "334053ec-d73a-51e1-9cd1-481487b181b5:indexpattern-datasource-layer-fb51d00c-6e2a-514f-a775-3e64e2c37195", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d0bffc64-50b7-5de6-8f0f-ed50cda30796:indexpattern-datasource-layer-181889fe-90e3-5c30-b75f-f0411a0ac138", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "82efd6ff-47ab-5957-92b3-ff013ad6fd2d:indexpattern-datasource-layer-cb829b24-4bc5-5934-bdd4-38b00af9d1e1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ac219908-ca85-5b5a-88f9-1f96a77ce979:indexpattern-datasource-layer-7fb571c8-8876-58ec-a1ae-00c5da9c1bec", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "8.9.0" +} diff --git a/packages/stormshield/kibana/dashboard/stormshield-5be8e340-235b-11ef-8b33-572717a2fc0b.json b/packages/stormshield/kibana/dashboard/stormshield-5be8e340-235b-11ef-8b33-572717a2fc0b.json index bd6bbacf75f..ee50b133e16 100644 --- a/packages/stormshield/kibana/dashboard/stormshield-5be8e340-235b-11ef-8b33-572717a2fc0b.json +++ b/packages/stormshield/kibana/dashboard/stormshield-5be8e340-235b-11ef-8b33-572717a2fc0b.json @@ -4,7 +4,7 @@ "chainingSystem": "HIERARCHICAL", "controlStyle": "oneLine", "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", - "panelsJSON": "{\"440785c6-61cc-4a85-a129-e4aa5f32590f\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"440785c6-61cc-4a85-a129-e4aa5f32590f\",\"fieldName\":\"stormshield.fw\",\"title\":\"Firewall Id\",\"grow\":false,\"width\":\"small\",\"enhancements\":{}}},\"0e8afad9-83ae-43ac-8f0e-aac581300173\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0e8afad9-83ae-43ac-8f0e-aac581300173\",\"fieldName\":\"event.action\",\"title\":\"event.action\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{},\"selectedOptions\":[]}},\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\",\"fieldName\":\"log.syslog.facility.name\",\"title\":\"Syslog facility\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"fa254ad2-d372-4df0-91f1-e277f993a09d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fa254ad2-d372-4df0-91f1-e277f993a09d\",\"fieldName\":\"log.syslog.severity.name\",\"title\":\"Syslog severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"ae4ce062-41ad-4fc1-8ac3-09f03a97c01e\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ae4ce062-41ad-4fc1-8ac3-09f03a97c01e\",\"fieldName\":\"stormshield.logtype\",\"title\":\"SNS event type\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\",\"fieldName\":\"user.name\",\"title\":\"User\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}}}" + "panelsJSON": "{\"440785c6-61cc-4a85-a129-e4aa5f32590f\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"440785c6-61cc-4a85-a129-e4aa5f32590f\",\"fieldName\":\"stormshield.fw\",\"title\":\"Firewall Id\",\"grow\":false,\"width\":\"small\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"0e8afad9-83ae-43ac-8f0e-aac581300173\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0e8afad9-83ae-43ac-8f0e-aac581300173\",\"fieldName\":\"event.action\",\"title\":\"event.action\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{},\"selectedOptions\":[],\"dataViewId\":\"logs-*\"}},\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\",\"fieldName\":\"log.syslog.facility.name\",\"title\":\"Syslog facility\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"fa254ad2-d372-4df0-91f1-e277f993a09d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fa254ad2-d372-4df0-91f1-e277f993a09d\",\"fieldName\":\"log.syslog.severity.name\",\"title\":\"Syslog severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"ae4ce062-41ad-4fc1-8ac3-09f03a97c01e\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ae4ce062-41ad-4fc1-8ac3-09f03a97c01e\",\"fieldName\":\"stormshield.logtype\",\"title\":\"SNS event type\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\",\"fieldName\":\"user.name\",\"title\":\"User\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}}}" }, "description": "", "kibanaSavedObjectMeta": { @@ -47,6 +47,72 @@ "useMargins": true }, "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "layout": "horizontal", + "links": [ + { + "destinationRefName": "link_a5e8d95a-d477-52e9-90b0-7ca4489a0ed5_dashboard", + "id": "a5e8d95a-d477-52e9-90b0-7ca4489a0ed5", + "label": "Alarms (IPS)", + "options": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": false + }, + "order": 0, + "type": "dashboardLink" + }, + { + "destinationRefName": "link_06ad0154-6ba3-5ac1-87dd-069568d2b3f0_dashboard", + "id": "06ad0154-6ba3-5ac1-87dd-069568d2b3f0", + "label": "Network Traffic", + "options": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": false + }, + "order": 1, + "type": "dashboardLink" + }, + { + "destinationRefName": "link_42f63e9f-63db-528c-88bf-29aa3c53ac73_dashboard", + "id": "42f63e9f-63db-528c-88bf-29aa3c53ac73", + "label": "Users & VPN", + "options": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": false + }, + "order": 2, + "type": "dashboardLink" + }, + { + "destinationRefName": "link_92f1f5a3-474c-5b89-bf2a-4f47afec570b_dashboard", + "id": "92f1f5a3-474c-5b89-bf2a-4f47afec570b", + "label": "Web Activity", + "options": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": false + }, + "order": 3, + "type": "dashboardLink" + } + ] + } + }, + "gridData": { + "h": 4, + "i": "29ad3181-d80a-5775-9505-6c649cd6f7e4", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "29ad3181-d80a-5775-9505-6c649cd6f7e4", + "type": "links" + }, { "embeddableConfig": { "attributes": { @@ -171,7 +237,7 @@ "i": "78b49910-5be8-41e7-ade8-c78ceeb9a840", "w": 8, "x": 0, - "y": 0 + "y": 4 }, "panelIndex": "78b49910-5be8-41e7-ade8-c78ceeb9a840", "title": "Firewall Id", @@ -298,7 +364,7 @@ "i": "60803f93-b4a1-498e-ac81-c8b098cc1f64", "w": 9, "x": 8, - "y": 0 + "y": 4 }, "panelIndex": "60803f93-b4a1-498e-ac81-c8b098cc1f64", "title": "Network protocol", @@ -425,7 +491,7 @@ "i": "dc925ed2-b164-4a86-893d-ab5ed375d7c5", "w": 8, "x": 17, - "y": 0 + "y": 4 }, "panelIndex": "dc925ed2-b164-4a86-893d-ab5ed375d7c5", "title": "Network Transport", @@ -554,7 +620,7 @@ "i": "9c26fc0e-bb45-463a-a741-6f3c1963408b", "w": 9, "x": 25, - "y": 0 + "y": 4 }, "panelIndex": "9c26fc0e-bb45-463a-a741-6f3c1963408b", "title": "User ids", @@ -567,7 +633,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-2eb51a11-1872-4338-8e95-d883d82de16a", + "name": "indexpattern-datasource-layer-56d33ae4-e142-5274-9fc6-0a6cb310f925", "type": "index-pattern" } ], @@ -577,47 +643,35 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "2eb51a11-1872-4338-8e95-d883d82de16a": { + "56d33ae4-e142-5274-9fc6-0a6cb310f925": { "columnOrder": [ - "b518ba56-5e5a-4b86-8494-c22eff1b3a02", - "5d625986-62dc-471e-ad37-cebeb7895686" + "b6c28232-c6b3-5b17-9e66-740eab92b568", + "119b316f-e878-5b88-b73d-5c5bcf228c48" ], "columns": { - "5d625986-62dc-471e-ad37-cebeb7895686": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", + "b6c28232-c6b3-5b17-9e66-740eab92b568": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", "params": { - "emptyAsNull": true + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" }, - "scale": "ratio", - "sourceField": "___records___" + "scale": "interval", + "sourceField": "@timestamp" }, - "b518ba56-5e5a-4b86-8494-c22eff1b3a02": { + "119b316f-e878-5b88-b73d-5c5bcf228c48": { + "customLabel": true, "dataType": "number", - "isBucketed": true, - "label": "Top 3 values of event.duration", - "operationType": "terms", + "isBucketed": false, + "label": "Median duration (ns)", + "operationType": "median", "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "5d625986-62dc-471e-ad37-cebeb7895686", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 3 + "emptyAsNull": true }, - "scale": "ordinal", + "scale": "ratio", "sourceField": "event.duration" } }, @@ -661,19 +715,21 @@ "layers": [ { "accessors": [ - "5d625986-62dc-471e-ad37-cebeb7895686" + "119b316f-e878-5b88-b73d-5c5bcf228c48" ], - "layerId": "2eb51a11-1872-4338-8e95-d883d82de16a", + "layerId": "56d33ae4-e142-5274-9fc6-0a6cb310f925", "layerType": "data", - "seriesType": "bar_stacked", - "xAccessor": "b518ba56-5e5a-4b86-8494-c22eff1b3a02" + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "b6c28232-c6b3-5b17-9e66-740eab92b568" } ], "legend": { "isVisible": true, "position": "right" }, - "preferredSeriesType": "bar_stacked", + "preferredSeriesType": "line", "tickLabelsVisibilitySettings": { "x": true, "yLeft": true, @@ -682,7 +738,7 @@ "valueLabels": "hide" } }, - "title": "", + "title": "Median event duration", "type": "lens", "visualizationType": "lnsXY" }, @@ -691,13 +747,13 @@ }, "gridData": { "h": 7, - "i": "02a4ac94-5637-4a94-bb2c-3ebf8e51b51f", + "i": "788a0186-7447-5bda-8a7a-abfe911abb60", "w": 13, "x": 34, - "y": 0 + "y": 4 }, - "panelIndex": "02a4ac94-5637-4a94-bb2c-3ebf8e51b51f", - "title": "Event Duration", + "panelIndex": "788a0186-7447-5bda-8a7a-abfe911abb60", + "title": "Median event duration", "type": "lens" }, { @@ -761,7 +817,7 @@ "showBar": false } }, - "title": "", + "title": "Event count", "type": "lens", "visualizationType": "lnsMetric" }, @@ -772,10 +828,11 @@ "i": "3d709e25-2bfb-4d41-afba-fd20294402fe", "w": 7, "x": 0, - "y": 7 + "y": 11 }, "panelIndex": "3d709e25-2bfb-4d41-afba-fd20294402fe", - "type": "lens" + "type": "lens", + "title": "Event count" }, { "embeddableConfig": { @@ -896,7 +953,7 @@ "i": "964644c9-0298-426b-9418-2e6f8b7461ca", "w": 12, "x": 7, - "y": 7 + "y": 11 }, "panelIndex": "964644c9-0298-426b-9418-2e6f8b7461ca", "title": "Bytes through firewall", @@ -1023,7 +1080,7 @@ "i": "830893a2-44e4-406d-aebf-f5a9ccf2249a", "w": 11, "x": 19, - "y": 7 + "y": 11 }, "panelIndex": "830893a2-44e4-406d-aebf-f5a9ccf2249a", "title": "Syslog Severities", @@ -1149,7 +1206,7 @@ "i": "4e3b5faf-fab7-4c95-85c1-90adda30cc12", "w": 17, "x": 30, - "y": 7 + "y": 11 }, "panelIndex": "4e3b5faf-fab7-4c95-85c1-90adda30cc12", "title": "Event types", @@ -1268,7 +1325,7 @@ "i": "efb1898a-2955-448b-9a2a-fcee6e045353", "w": 7, "x": 0, - "y": 11 + "y": 15 }, "panelIndex": "efb1898a-2955-448b-9a2a-fcee6e045353", "title": "Alarm Actions", @@ -1305,7 +1362,7 @@ "i": "849aac11-40dd-48ff-a7fd-781e6fdd3703", "w": 25, "x": 0, - "y": 17 + "y": 21 }, "panelIndex": "849aac11-40dd-48ff-a7fd-781e6fdd3703", "title": "Connections", @@ -1435,7 +1492,7 @@ "i": "a6c9b8c8-e700-46fe-bb8b-fefd9acadf42", "w": 11, "x": 25, - "y": 17 + "y": 21 }, "panelIndex": "a6c9b8c8-e700-46fe-bb8b-fefd9acadf42", "title": "Source country", @@ -1565,7 +1622,7 @@ "i": "10e2f9c0-4504-4cb8-8cae-a5581174edca", "w": 11, "x": 36, - "y": 17 + "y": 21 }, "panelIndex": "10e2f9c0-4504-4cb8-8cae-a5581174edca", "title": "Source organization", @@ -1692,7 +1749,7 @@ "i": "1c3d3699-9dcb-48c0-b803-e027b3a164fd", "w": 11, "x": 25, - "y": 28 + "y": 32 }, "panelIndex": "1c3d3699-9dcb-48c0-b803-e027b3a164fd", "title": "Destination country", @@ -1822,15 +1879,326 @@ "i": "fce037f4-d69b-4554-965a-120a134a7b4f", "w": 11, "x": 36, - "y": 28 + "y": 32 }, "panelIndex": "fce037f4-d69b-4554-965a-120a134a7b4f", "title": "Destination organization", "type": "lens" + }, + { + "embeddableConfig": { + "savedVis": { + "title": "", + "type": "markdown", + "params": { + "fontSize": 12, + "markdown": "### Appliance health\n\nPeriodic statistics reported by the appliances (monitor, filterstat, count, routerstat, authstat and ipsecstat families).", + "openLinksInNewTab": false + }, + "uiState": {}, + "data": { + "aggs": [], + "searchSource": { + "query": { + "query": "", + "language": "kuery" + }, + "filter": [] + } + } + } + }, + "gridData": { + "h": 3, + "i": "d16e2f6a-e0b1-5052-8c48-80f43f1a0027", + "w": 48, + "x": 0, + "y": 43 + }, + "panelIndex": "d16e2f6a-e0b1-5052-8c48-80f43f1a0027", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f37d1189-ec5f-517d-adb3-ae28061ede41", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "f37d1189-ec5f-517d-adb3-ae28061ede41": { + "columnOrder": [ + "c8378013-b407-5c4a-a1b5-b43082b67788", + "982b45b7-1ced-5d98-8c7e-aea5e60e6002", + "e8591235-fe31-5f80-b460-aa216c571226" + ], + "columns": { + "c8378013-b407-5c4a-a1b5-b43082b67788": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e8591235-fe31-5f80-b460-aa216c571226": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "982b45b7-1ced-5d98-8c7e-aea5e60e6002": { + "dataType": "string", + "isBucketed": true, + "label": "Top 6 values of stormshield.logtype", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e8591235-fe31-5f80-b460-aa216c571226", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 6 + }, + "scale": "ordinal", + "sourceField": "stormshield.logtype" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "stormshield.logtype: (monitor OR filterstat OR count OR routerstat OR authstat OR ipsecstat)" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e8591235-fe31-5f80-b460-aa216c571226" + ], + "layerId": "f37d1189-ec5f-517d-adb3-ae28061ede41", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "c8378013-b407-5c4a-a1b5-b43082b67788", + "splitAccessor": "982b45b7-1ced-5d98-8c7e-aea5e60e6002" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Appliance statistics over time", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "bf30ab94-0fc0-524a-a1ef-42fc7f1730bf", + "w": 32, + "x": 0, + "y": 46 + }, + "panelIndex": "bf30ab94-0fc0-524a-a1ef-42fc7f1730bf", + "title": "Appliance statistics over time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-18aa8ad1-f0de-5e4a-8063-1f304ff56a8d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "18aa8ad1-f0de-5e4a-8063-1f304ff56a8d": { + "columnOrder": [ + "50c1ff73-df0b-5fe1-ad89-c5b96182ee25", + "3b502e9a-ed06-5098-89a4-714b1f7d15b8" + ], + "columns": { + "3b502e9a-ed06-5098-89a4-714b1f7d15b8": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "50c1ff73-df0b-5fe1-ad89-c5b96182ee25": { + "dataType": "string", + "isBucketed": true, + "label": "Top 6 values of stormshield.logtype", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3b502e9a-ed06-5098-89a4-714b1f7d15b8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 6 + }, + "scale": "ordinal", + "sourceField": "stormshield.logtype" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "stormshield.logtype: (monitor OR filterstat OR count OR routerstat OR authstat OR ipsecstat)" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "18aa8ad1-f0de-5e4a-8063-1f304ff56a8d", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "3b502e9a-ed06-5098-89a4-714b1f7d15b8" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "50c1ff73-df0b-5fe1-ad89-c5b96182ee25" + ] + } + ], + "shape": "donut" + } + }, + "title": "Statistics families", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "df009713-3132-5547-bc84-e2f1c193db49", + "w": 16, + "x": 32, + "y": 46 + }, + "panelIndex": "df009713-3132-5547-bc84-e2f1c193db49", + "title": "Statistics families", + "type": "lens" } ], "timeRestore": false, - "title": "[Stormshield] Overview", + "title": "[Stormshield SNS] Overview", "version": 1 }, "coreMigrationVersion": "8.8.0", @@ -1863,11 +2231,6 @@ "name": "9c26fc0e-bb45-463a-a741-6f3c1963408b:indexpattern-datasource-layer-10b34c0d-76ee-42a5-91fa-2ea9c7580808", "type": "index-pattern" }, - { - "id": "logs-*", - "name": "02a4ac94-5637-4a94-bb2c-3ebf8e51b51f:indexpattern-datasource-layer-2eb51a11-1872-4338-8e95-d883d82de16a", - "type": "index-pattern" - }, { "id": "logs-*", "name": "3d709e25-2bfb-4d41-afba-fd20294402fe:indexpattern-datasource-layer-aa5343d0-26f1-49a9-8e89-acce9eba8e6a", @@ -1957,6 +2320,41 @@ "id": "logs-*", "name": "controlGroup_df708a52-f811-4be0-b0ca-3384d1a6ef6e:optionsListDataView", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "788a0186-7447-5bda-8a7a-abfe911abb60:indexpattern-datasource-layer-56d33ae4-e142-5274-9fc6-0a6cb310f925", + "type": "index-pattern" + }, + { + "id": "stormshield-3f2a9c60-1a4e-11f1-9adf-0242ac120002", + "name": "29ad3181-d80a-5775-9505-6c649cd6f7e4:link_a5e8d95a-d477-52e9-90b0-7ca4489a0ed5_dashboard", + "type": "dashboard" + }, + { + "id": "stormshield-9a770ec4-ac09-5bc9-91fb-eedad71b19ed", + "name": "29ad3181-d80a-5775-9505-6c649cd6f7e4:link_06ad0154-6ba3-5ac1-87dd-069568d2b3f0_dashboard", + "type": "dashboard" + }, + { + "id": "stormshield-63f75f12-2c75-5545-aee4-27fb350ff92f", + "name": "29ad3181-d80a-5775-9505-6c649cd6f7e4:link_42f63e9f-63db-528c-88bf-29aa3c53ac73_dashboard", + "type": "dashboard" + }, + { + "id": "stormshield-bf67b6e6-d546-5d7b-9dde-5815fe21da2b", + "name": "29ad3181-d80a-5775-9505-6c649cd6f7e4:link_92f1f5a3-474c-5b89-bf2a-4f47afec570b_dashboard", + "type": "dashboard" + }, + { + "id": "logs-*", + "name": "bf30ab94-0fc0-524a-a1ef-42fc7f1730bf:indexpattern-datasource-layer-f37d1189-ec5f-517d-adb3-ae28061ede41", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "df009713-3132-5547-bc84-e2f1c193db49:indexpattern-datasource-layer-18aa8ad1-f0de-5e4a-8063-1f304ff56a8d", + "type": "index-pattern" } ], "type": "dashboard", diff --git a/packages/stormshield/kibana/dashboard/stormshield-63f75f12-2c75-5545-aee4-27fb350ff92f.json b/packages/stormshield/kibana/dashboard/stormshield-63f75f12-2c75-5545-aee4-27fb350ff92f.json new file mode 100644 index 00000000000..bd8b9d58206 --- /dev/null +++ b/packages/stormshield/kibana/dashboard/stormshield-63f75f12-2c75-5545-aee4-27fb350ff92f.json @@ -0,0 +1,1238 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"440785c6-61cc-4a85-a129-e4aa5f32590f\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"440785c6-61cc-4a85-a129-e4aa5f32590f\",\"fieldName\":\"stormshield.fw\",\"title\":\"Firewall Id\",\"grow\":false,\"width\":\"small\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"0e8afad9-83ae-43ac-8f0e-aac581300173\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0e8afad9-83ae-43ac-8f0e-aac581300173\",\"fieldName\":\"event.action\",\"title\":\"event.action\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{},\"selectedOptions\":[],\"dataViewId\":\"logs-*\"}},\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\",\"fieldName\":\"log.syslog.facility.name\",\"title\":\"Syslog facility\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"fa254ad2-d372-4df0-91f1-e277f993a09d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fa254ad2-d372-4df0-91f1-e277f993a09d\",\"fieldName\":\"log.syslog.severity.name\",\"title\":\"Syslog severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\",\"fieldName\":\"user.name\",\"title\":\"User\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}}}" + }, + "description": "Authentication, administration sessions and IPsec/SSL VPN events from Stormshield SNS firewalls, with their outcomes.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "stormshield.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "stormshield.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "stormshield.logtype", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "stormshield.logtype", + "negate": false, + "params": [ + "auth", + "server", + "vpn", + "xvpn" + ], + "type": "phrases" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "stormshield.logtype": "auth" + } + }, + { + "match_phrase": { + "stormshield.logtype": "server" + } + }, + { + "match_phrase": { + "stormshield.logtype": "vpn" + } + }, + { + "match_phrase": { + "stormshield.logtype": "xvpn" + } + } + ] + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-31555dc9-9c86-5c2b-9331-da5e5c86431a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "31555dc9-9c86-5c2b-9331-da5e5c86431a": { + "columnOrder": [ + "5a3d8c83-23e6-53df-83c5-00f156c3917c", + "2a7fb575-0c0e-5265-a6d5-877075326b24", + "47ea5c5c-1180-5b57-b631-115cbad12d42" + ], + "columns": { + "5a3d8c83-23e6-53df-83c5-00f156c3917c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "47ea5c5c-1180-5b57-b631-115cbad12d42": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "2a7fb575-0c0e-5265-a6d5-877075326b24": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of event.outcome", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "47ea5c5c-1180-5b57-b631-115cbad12d42", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "47ea5c5c-1180-5b57-b631-115cbad12d42" + ], + "layerId": "31555dc9-9c86-5c2b-9331-da5e5c86431a", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "5a3d8c83-23e6-53df-83c5-00f156c3917c", + "splitAccessor": "2a7fb575-0c0e-5265-a6d5-877075326b24" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Authentication and VPN events over time", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "33f91bc5-9e79-5b06-9fd4-4738d46650ab", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "33f91bc5-9e79-5b06-9fd4-4738d46650ab", + "title": "Authentication and VPN events over time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9e9b089e-d05d-5964-839d-baa0dd699e82", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9e9b089e-d05d-5964-839d-baa0dd699e82": { + "columnOrder": [ + "b65b4986-12d8-5991-bb9f-bd130959acc4" + ], + "columns": { + "b65b4986-12d8-5991-bb9f-bd130959acc4": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "9e9b089e-d05d-5964-839d-baa0dd699e82", + "layerType": "data", + "metricAccessor": "b65b4986-12d8-5991-bb9f-bd130959acc4" + } + }, + "title": "Event count", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} + }, + "gridData": { + "h": 9, + "i": "e20851d1-14ec-58e4-a0f8-9b3c3f36a22b", + "w": 8, + "x": 24, + "y": 0 + }, + "panelIndex": "e20851d1-14ec-58e4-a0f8-9b3c3f36a22b", + "type": "lens", + "title": "Event count" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a9087fce-0080-536b-9f3f-fe432adf47ed", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "a9087fce-0080-536b-9f3f-fe432adf47ed": { + "columnOrder": [ + "a282a1ad-a63c-5bee-a578-5157e6c1c819", + "bca46d52-ae25-5dea-bcea-aaad90fcc758" + ], + "columns": { + "bca46d52-ae25-5dea-bcea-aaad90fcc758": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "a282a1ad-a63c-5bee-a578-5157e6c1c819": { + "dataType": "string", + "isBucketed": true, + "label": "Top 3 values of event.outcome", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bca46d52-ae25-5dea-bcea-aaad90fcc758", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 3 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "a9087fce-0080-536b-9f3f-fe432adf47ed", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "bca46d52-ae25-5dea-bcea-aaad90fcc758" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "a282a1ad-a63c-5bee-a578-5157e6c1c819" + ] + } + ], + "shape": "donut" + } + }, + "title": "Outcomes", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "698cc51c-6c45-55c6-869d-0859e1f6a403", + "w": 16, + "x": 32, + "y": 0 + }, + "panelIndex": "698cc51c-6c45-55c6-869d-0859e1f6a403", + "title": "Outcomes", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-008cd50c-407b-55ed-8421-44e9d84a5b6a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "008cd50c-407b-55ed-8421-44e9d84a5b6a": { + "columnOrder": [ + "5ddb0153-ba8e-5252-951c-7d8454b031ff", + "e28ec590-1238-57f0-8a93-86e61c1f22b8" + ], + "columns": { + "e28ec590-1238-57f0-8a93-86e61c1f22b8": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5ddb0153-ba8e-5252-951c-7d8454b031ff": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of user.name", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e28ec590-1238-57f0-8a93-86e61c1f22b8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "008cd50c-407b-55ed-8421-44e9d84a5b6a", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "e28ec590-1238-57f0-8a93-86e61c1f22b8" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "5ddb0153-ba8e-5252-951c-7d8454b031ff" + ] + } + ], + "shape": "donut" + } + }, + "title": "Top users", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "b4a49986-1e0b-5331-a4df-f31c9bd8d474", + "w": 12, + "x": 0, + "y": 9 + }, + "panelIndex": "b4a49986-1e0b-5331-a4df-f31c9bd8d474", + "title": "Top users", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b79edfdb-4889-5989-90dd-871a4526dba8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "b79edfdb-4889-5989-90dd-871a4526dba8": { + "columnOrder": [ + "2e81916e-911d-516c-9f0e-267e3e90327f", + "be0668e1-2293-5f4c-bbc0-5972d09e1698" + ], + "columns": { + "be0668e1-2293-5f4c-bbc0-5972d09e1698": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "2e81916e-911d-516c-9f0e-267e3e90327f": { + "dataType": "string", + "isBucketed": true, + "label": "Top 8 values of user.domain", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "be0668e1-2293-5f4c-bbc0-5972d09e1698", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 8 + }, + "scale": "ordinal", + "sourceField": "user.domain" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "b79edfdb-4889-5989-90dd-871a4526dba8", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "be0668e1-2293-5f4c-bbc0-5972d09e1698" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2e81916e-911d-516c-9f0e-267e3e90327f" + ] + } + ], + "shape": "donut" + } + }, + "title": "User directories", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "dbc4a5aa-0b35-5487-bb4a-52cd501558a7", + "w": 12, + "x": 12, + "y": 9 + }, + "panelIndex": "dbc4a5aa-0b35-5487-bb4a-52cd501558a7", + "title": "User directories", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8196f0c2-93bc-54bd-8022-49b3373e0ccd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "8196f0c2-93bc-54bd-8022-49b3373e0ccd": { + "columnOrder": [ + "f2543eed-303e-5f69-9894-24888384fc1f", + "ee4e5e82-408a-5cfa-99a7-93ac6ee32c05" + ], + "columns": { + "ee4e5e82-408a-5cfa-99a7-93ac6ee32c05": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f2543eed-303e-5f69-9894-24888384fc1f": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of user.group.name", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ee4e5e82-408a-5cfa-99a7-93ac6ee32c05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.group.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "8196f0c2-93bc-54bd-8022-49b3373e0ccd", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "ee4e5e82-408a-5cfa-99a7-93ac6ee32c05" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "f2543eed-303e-5f69-9894-24888384fc1f" + ] + } + ], + "shape": "donut" + } + }, + "title": "User groups", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "48b1d410-b52d-50e1-bef9-8a5985db7bc5", + "w": 12, + "x": 24, + "y": 9 + }, + "panelIndex": "48b1d410-b52d-50e1-bef9-8a5985db7bc5", + "title": "User groups", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-492a1bb7-a185-54d2-b5b8-25d50a4ed2bf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "492a1bb7-a185-54d2-b5b8-25d50a4ed2bf": { + "columnOrder": [ + "ac8d78c8-7738-5f2d-8883-651801fdbe3f", + "82d97990-cc70-588f-acde-b928069ba8c6" + ], + "columns": { + "82d97990-cc70-588f-acde-b928069ba8c6": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ac8d78c8-7738-5f2d-8883-651801fdbe3f": { + "dataType": "string", + "isBucketed": true, + "label": "Top 4 values of stormshield.logtype", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "82d97990-cc70-588f-acde-b928069ba8c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 4 + }, + "scale": "ordinal", + "sourceField": "stormshield.logtype" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "492a1bb7-a185-54d2-b5b8-25d50a4ed2bf", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "82d97990-cc70-588f-acde-b928069ba8c6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ac8d78c8-7738-5f2d-8883-651801fdbe3f" + ] + } + ], + "shape": "donut" + } + }, + "title": "Event families", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "565c98df-6722-5682-bc97-bfc6639c236b", + "w": 12, + "x": 36, + "y": 9 + }, + "panelIndex": "565c98df-6722-5682-bc97-bfc6639c236b", + "title": "Event families", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-57c9928a-6a0a-5a3f-aeed-24bc46c761e6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "57c9928a-6a0a-5a3f-aeed-24bc46c761e6": { + "columnOrder": [ + "86438d8c-a8f8-5d42-922b-84bd7b765707", + "ef81aa29-6eac-5bcc-89e8-6436214ed6e3" + ], + "columns": { + "ef81aa29-6eac-5bcc-89e8-6436214ed6e3": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "86438d8c-a8f8-5d42-922b-84bd7b765707": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of destination.ip", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ef81aa29-6eac-5bcc-89e8-6436214ed6e3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "57c9928a-6a0a-5a3f-aeed-24bc46c761e6", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "ef81aa29-6eac-5bcc-89e8-6436214ed6e3" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "86438d8c-a8f8-5d42-922b-84bd7b765707" + ] + } + ], + "shape": "donut" + } + }, + "title": "Top VPN peers", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "4697e556-996f-54a1-ae6e-a912830c0d22", + "w": 24, + "x": 0, + "y": 18 + }, + "panelIndex": "4697e556-996f-54a1-ae6e-a912830c0d22", + "title": "Top VPN peers", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-835c619b-dbaa-5038-914d-fde70005fab7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "835c619b-dbaa-5038-914d-fde70005fab7": { + "columnOrder": [ + "498ee73e-1f42-57eb-a8de-2e7d024b88a5", + "4c20fbf3-707b-5ead-aae2-9270d00fb1c3" + ], + "columns": { + "4c20fbf3-707b-5ead-aae2-9270d00fb1c3": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "498ee73e-1f42-57eb-a8de-2e7d024b88a5": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of source.geo.country_name", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4c20fbf3-707b-5ead-aae2-9270d00fb1c3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.geo.country_name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "835c619b-dbaa-5038-914d-fde70005fab7", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "4c20fbf3-707b-5ead-aae2-9270d00fb1c3" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "498ee73e-1f42-57eb-a8de-2e7d024b88a5" + ] + } + ], + "shape": "donut" + } + }, + "title": "Source countries", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "adda7654-d366-5222-b3e1-c5afec48ae7e", + "w": 24, + "x": 24, + "y": 18 + }, + "panelIndex": "adda7654-d366-5222-b3e1-c5afec48ae7e", + "title": "Source countries", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Stormshield SNS] Users & VPN", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "id": "stormshield-63f75f12-2c75-5545-aee4-27fb350ff92f", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "33f91bc5-9e79-5b06-9fd4-4738d46650ab:indexpattern-datasource-layer-31555dc9-9c86-5c2b-9331-da5e5c86431a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e20851d1-14ec-58e4-a0f8-9b3c3f36a22b:indexpattern-datasource-layer-9e9b089e-d05d-5964-839d-baa0dd699e82", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "698cc51c-6c45-55c6-869d-0859e1f6a403:indexpattern-datasource-layer-a9087fce-0080-536b-9f3f-fe432adf47ed", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b4a49986-1e0b-5331-a4df-f31c9bd8d474:indexpattern-datasource-layer-008cd50c-407b-55ed-8421-44e9d84a5b6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dbc4a5aa-0b35-5487-bb4a-52cd501558a7:indexpattern-datasource-layer-b79edfdb-4889-5989-90dd-871a4526dba8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "48b1d410-b52d-50e1-bef9-8a5985db7bc5:indexpattern-datasource-layer-8196f0c2-93bc-54bd-8022-49b3373e0ccd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "565c98df-6722-5682-bc97-bfc6639c236b:indexpattern-datasource-layer-492a1bb7-a185-54d2-b5b8-25d50a4ed2bf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4697e556-996f-54a1-ae6e-a912830c0d22:indexpattern-datasource-layer-57c9928a-6a0a-5a3f-aeed-24bc46c761e6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "adda7654-d366-5222-b3e1-c5afec48ae7e:indexpattern-datasource-layer-835c619b-dbaa-5038-914d-fde70005fab7", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "8.9.0" +} diff --git a/packages/stormshield/kibana/dashboard/stormshield-9a770ec4-ac09-5bc9-91fb-eedad71b19ed.json b/packages/stormshield/kibana/dashboard/stormshield-9a770ec4-ac09-5bc9-91fb-eedad71b19ed.json new file mode 100644 index 00000000000..c4569bf2924 --- /dev/null +++ b/packages/stormshield/kibana/dashboard/stormshield-9a770ec4-ac09-5bc9-91fb-eedad71b19ed.json @@ -0,0 +1,1236 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"440785c6-61cc-4a85-a129-e4aa5f32590f\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"440785c6-61cc-4a85-a129-e4aa5f32590f\",\"fieldName\":\"stormshield.fw\",\"title\":\"Firewall Id\",\"grow\":false,\"width\":\"small\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"0e8afad9-83ae-43ac-8f0e-aac581300173\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0e8afad9-83ae-43ac-8f0e-aac581300173\",\"fieldName\":\"event.action\",\"title\":\"event.action\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{},\"selectedOptions\":[],\"dataViewId\":\"logs-*\"}},\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\",\"fieldName\":\"log.syslog.facility.name\",\"title\":\"Syslog facility\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"fa254ad2-d372-4df0-91f1-e277f993a09d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fa254ad2-d372-4df0-91f1-e277f993a09d\",\"fieldName\":\"log.syslog.severity.name\",\"title\":\"Syslog severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\",\"fieldName\":\"user.name\",\"title\":\"User\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}}}" + }, + "description": "Connection and filter events from Stormshield SNS firewalls: volumes, endpoints, rules and verdicts.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "stormshield.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "stormshield.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "stormshield.logtype", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "stormshield.logtype", + "negate": false, + "params": [ + "connection", + "filter" + ], + "type": "phrases" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "stormshield.logtype": "connection" + } + }, + { + "match_phrase": { + "stormshield.logtype": "filter" + } + } + ] + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b33a987c-11d6-5805-8a17-5851d4dba25d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "b33a987c-11d6-5805-8a17-5851d4dba25d": { + "columnOrder": [ + "29b43da2-401b-58b7-8a8b-cfde85e9660d", + "d6eaa10e-aee7-5831-8657-591298375ac5", + "b13d71e8-0bba-5e8d-b032-6f4ef334f5f8" + ], + "columns": { + "29b43da2-401b-58b7-8a8b-cfde85e9660d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b13d71e8-0bba-5e8d-b032-6f4ef334f5f8": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d6eaa10e-aee7-5831-8657-591298375ac5": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of event.action", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b13d71e8-0bba-5e8d-b032-6f4ef334f5f8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b13d71e8-0bba-5e8d-b032-6f4ef334f5f8" + ], + "layerId": "b33a987c-11d6-5805-8a17-5851d4dba25d", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "29b43da2-401b-58b7-8a8b-cfde85e9660d", + "splitAccessor": "d6eaa10e-aee7-5831-8657-591298375ac5" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Traffic events over time", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "7360644b-815b-5dd8-b561-0fe319696831", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "7360644b-815b-5dd8-b561-0fe319696831", + "title": "Traffic events over time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5ee97d1f-1472-5f32-8fee-9c8fcac34cdd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5ee97d1f-1472-5f32-8fee-9c8fcac34cdd": { + "columnOrder": [ + "5f490f24-b957-5856-9b1b-2d065c17c299" + ], + "columns": { + "5f490f24-b957-5856-9b1b-2d065c17c299": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "5ee97d1f-1472-5f32-8fee-9c8fcac34cdd", + "layerType": "data", + "metricAccessor": "5f490f24-b957-5856-9b1b-2d065c17c299" + } + }, + "title": "Traffic event count", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} + }, + "gridData": { + "h": 9, + "i": "1681dbfe-186a-5a11-888c-3c28aecead84", + "w": 8, + "x": 24, + "y": 0 + }, + "panelIndex": "1681dbfe-186a-5a11-888c-3c28aecead84", + "type": "lens", + "title": "Traffic event count" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-71b63ac9-9af1-5a23-ad1d-2ad1d1d504e9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "71b63ac9-9af1-5a23-ad1d-2ad1d1d504e9": { + "columnOrder": [ + "ec219ec3-5408-5c6a-a26d-2a0c7ae3d742", + "2b184d58-f9ee-53cf-96eb-1e53f15d9208" + ], + "columns": { + "ec219ec3-5408-5c6a-a26d-2a0c7ae3d742": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "2b184d58-f9ee-53cf-96eb-1e53f15d9208": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "2b184d58-f9ee-53cf-96eb-1e53f15d9208" + ], + "layerId": "71b63ac9-9af1-5a23-ad1d-2ad1d1d504e9", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "ec219ec3-5408-5c6a-a26d-2a0c7ae3d742" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Network bytes over time", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "2599d627-911d-5d8e-9e80-24ed49c262bb", + "w": 16, + "x": 32, + "y": 0 + }, + "panelIndex": "2599d627-911d-5d8e-9e80-24ed49c262bb", + "title": "Network bytes over time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3ab86e1a-24bd-574d-a561-cf618a2e7ad6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "3ab86e1a-24bd-574d-a561-cf618a2e7ad6": { + "columnOrder": [ + "8af489fb-6e76-5de4-887b-2adc4b2d080a", + "5e851636-2f89-5d73-be8f-89e51771cbd0" + ], + "columns": { + "5e851636-2f89-5d73-be8f-89e51771cbd0": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8af489fb-6e76-5de4-887b-2adc4b2d080a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of source.ip", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5e851636-2f89-5d73-be8f-89e51771cbd0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "3ab86e1a-24bd-574d-a561-cf618a2e7ad6", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "5e851636-2f89-5d73-be8f-89e51771cbd0" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8af489fb-6e76-5de4-887b-2adc4b2d080a" + ] + } + ], + "shape": "donut" + } + }, + "title": "Top source addresses", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "1fa7b6dc-06f9-53f9-94bd-20a0c18c2c18", + "w": 12, + "x": 0, + "y": 9 + }, + "panelIndex": "1fa7b6dc-06f9-53f9-94bd-20a0c18c2c18", + "title": "Top source addresses", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c29e7546-c858-5c19-b189-e8af6344fd8a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "c29e7546-c858-5c19-b189-e8af6344fd8a": { + "columnOrder": [ + "84a8685b-7f8e-51e3-adb5-edb9bbb08606", + "264f01a3-4c72-5481-9baa-a08753456b1d" + ], + "columns": { + "264f01a3-4c72-5481-9baa-a08753456b1d": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "84a8685b-7f8e-51e3-adb5-edb9bbb08606": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of destination.ip", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "264f01a3-4c72-5481-9baa-a08753456b1d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "c29e7546-c858-5c19-b189-e8af6344fd8a", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "264f01a3-4c72-5481-9baa-a08753456b1d" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "84a8685b-7f8e-51e3-adb5-edb9bbb08606" + ] + } + ], + "shape": "donut" + } + }, + "title": "Top destination addresses", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "2320183c-5cfa-5725-9433-5e3dfbeb3030", + "w": 12, + "x": 12, + "y": 9 + }, + "panelIndex": "2320183c-5cfa-5725-9433-5e3dfbeb3030", + "title": "Top destination addresses", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e3c749ef-e4ca-5fea-86ca-ab8eebe863a6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "e3c749ef-e4ca-5fea-86ca-ab8eebe863a6": { + "columnOrder": [ + "d46c7206-421d-5406-8c0e-91571ddb7849", + "01915b51-0f05-5ddf-89a8-2d54a757711f" + ], + "columns": { + "01915b51-0f05-5ddf-89a8-2d54a757711f": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d46c7206-421d-5406-8c0e-91571ddb7849": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of destination.port", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "01915b51-0f05-5ddf-89a8-2d54a757711f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.port" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "e3c749ef-e4ca-5fea-86ca-ab8eebe863a6", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "01915b51-0f05-5ddf-89a8-2d54a757711f" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d46c7206-421d-5406-8c0e-91571ddb7849" + ] + } + ], + "shape": "donut" + } + }, + "title": "Top destination ports", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "0e2ea9f7-64c8-5e5f-b540-a917eacdb437", + "w": 12, + "x": 24, + "y": 9 + }, + "panelIndex": "0e2ea9f7-64c8-5e5f-b540-a917eacdb437", + "title": "Top destination ports", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b6d00329-d3ed-5b10-9d1a-0287c24d8959", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "b6d00329-d3ed-5b10-9d1a-0287c24d8959": { + "columnOrder": [ + "f541ed5a-ca16-5103-bf4d-4030c72a71b8", + "fa0564a7-b4fe-519f-8228-9a996a10917a" + ], + "columns": { + "fa0564a7-b4fe-519f-8228-9a996a10917a": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f541ed5a-ca16-5103-bf4d-4030c72a71b8": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of network.direction", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "fa0564a7-b4fe-519f-8228-9a996a10917a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.direction" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "b6d00329-d3ed-5b10-9d1a-0287c24d8959", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "fa0564a7-b4fe-519f-8228-9a996a10917a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "f541ed5a-ca16-5103-bf4d-4030c72a71b8" + ] + } + ], + "shape": "donut" + } + }, + "title": "Network direction", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "dd3bfcdc-e902-583e-8ada-6a432f95e941", + "w": 12, + "x": 36, + "y": 9 + }, + "panelIndex": "dd3bfcdc-e902-583e-8ada-6a432f95e941", + "title": "Network direction", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-55f0eb15-5d6a-5f31-b214-54bccb470a9b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "55f0eb15-5d6a-5f31-b214-54bccb470a9b": { + "columnOrder": [ + "cb2931b1-4ece-507f-a025-924933c385f9", + "9c317bf7-a1f0-5171-92e7-bae29d811e79" + ], + "columns": { + "9c317bf7-a1f0-5171-92e7-bae29d811e79": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cb2931b1-4ece-507f-a025-924933c385f9": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of rule.id", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c317bf7-a1f0-5171-92e7-bae29d811e79", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "rule.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "55f0eb15-5d6a-5f31-b214-54bccb470a9b", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "9c317bf7-a1f0-5171-92e7-bae29d811e79" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "cb2931b1-4ece-507f-a025-924933c385f9" + ] + } + ], + "shape": "donut" + } + }, + "title": "Top rules", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "440ca643-b143-5410-82e7-9dbacbc7ee4e", + "w": 24, + "x": 0, + "y": 18 + }, + "panelIndex": "440ca643-b143-5410-82e7-9dbacbc7ee4e", + "title": "Top rules", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9afcf1c0-c2cd-5240-b895-3a6ad58851e6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "9afcf1c0-c2cd-5240-b895-3a6ad58851e6": { + "columnOrder": [ + "241510ba-bad1-516b-abb5-bc661267847e", + "39350821-f4da-5cee-9c9b-cd1b95ba3f39" + ], + "columns": { + "39350821-f4da-5cee-9c9b-cd1b95ba3f39": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "241510ba-bad1-516b-abb5-bc661267847e": { + "dataType": "string", + "isBucketed": true, + "label": "Top 8 values of network.transport", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "39350821-f4da-5cee-9c9b-cd1b95ba3f39", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 8 + }, + "scale": "ordinal", + "sourceField": "network.transport" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9afcf1c0-c2cd-5240-b895-3a6ad58851e6", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "39350821-f4da-5cee-9c9b-cd1b95ba3f39" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "241510ba-bad1-516b-abb5-bc661267847e" + ] + } + ], + "shape": "donut" + } + }, + "title": "Transport protocols", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "55a95a5a-88f5-50eb-9b96-437296577a1d", + "w": 24, + "x": 24, + "y": 18 + }, + "panelIndex": "55a95a5a-88f5-50eb-9b96-437296577a1d", + "title": "Transport protocols", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Stormshield SNS] Network Traffic", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "id": "stormshield-9a770ec4-ac09-5bc9-91fb-eedad71b19ed", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7360644b-815b-5dd8-b561-0fe319696831:indexpattern-datasource-layer-b33a987c-11d6-5805-8a17-5851d4dba25d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1681dbfe-186a-5a11-888c-3c28aecead84:indexpattern-datasource-layer-5ee97d1f-1472-5f32-8fee-9c8fcac34cdd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2599d627-911d-5d8e-9e80-24ed49c262bb:indexpattern-datasource-layer-71b63ac9-9af1-5a23-ad1d-2ad1d1d504e9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1fa7b6dc-06f9-53f9-94bd-20a0c18c2c18:indexpattern-datasource-layer-3ab86e1a-24bd-574d-a561-cf618a2e7ad6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2320183c-5cfa-5725-9433-5e3dfbeb3030:indexpattern-datasource-layer-c29e7546-c858-5c19-b189-e8af6344fd8a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e2ea9f7-64c8-5e5f-b540-a917eacdb437:indexpattern-datasource-layer-e3c749ef-e4ca-5fea-86ca-ab8eebe863a6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dd3bfcdc-e902-583e-8ada-6a432f95e941:indexpattern-datasource-layer-b6d00329-d3ed-5b10-9d1a-0287c24d8959", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "440ca643-b143-5410-82e7-9dbacbc7ee4e:indexpattern-datasource-layer-55f0eb15-5d6a-5f31-b214-54bccb470a9b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "55a95a5a-88f5-50eb-9b96-437296577a1d:indexpattern-datasource-layer-9afcf1c0-c2cd-5240-b895-3a6ad58851e6", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "8.9.0" +} diff --git a/packages/stormshield/kibana/dashboard/stormshield-bf67b6e6-d546-5d7b-9dde-5815fe21da2b.json b/packages/stormshield/kibana/dashboard/stormshield-bf67b6e6-d546-5d7b-9dde-5815fe21da2b.json new file mode 100644 index 00000000000..d7f84f21f41 --- /dev/null +++ b/packages/stormshield/kibana/dashboard/stormshield-bf67b6e6-d546-5d7b-9dde-5815fe21da2b.json @@ -0,0 +1,1112 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"440785c6-61cc-4a85-a129-e4aa5f32590f\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"440785c6-61cc-4a85-a129-e4aa5f32590f\",\"fieldName\":\"stormshield.fw\",\"title\":\"Firewall Id\",\"grow\":false,\"width\":\"small\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"0e8afad9-83ae-43ac-8f0e-aac581300173\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0e8afad9-83ae-43ac-8f0e-aac581300173\",\"fieldName\":\"event.action\",\"title\":\"event.action\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{},\"selectedOptions\":[],\"dataViewId\":\"logs-*\"}},\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"419c6dd9-f52e-4ecb-a8d0-bec91ec966b0\",\"fieldName\":\"log.syslog.facility.name\",\"title\":\"Syslog facility\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"fa254ad2-d372-4df0-91f1-e277f993a09d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fa254ad2-d372-4df0-91f1-e277f993a09d\",\"fieldName\":\"log.syslog.severity.name\",\"title\":\"Syslog severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}},\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"df708a52-f811-4be0-b0ca-3384d1a6ef6e\",\"fieldName\":\"user.name\",\"title\":\"User\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{},\"dataViewId\":\"logs-*\"}}}" + }, + "description": "HTTP proxy activity from Stormshield SNS web logs: domains, methods, return codes and volumes.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "stormshield.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "stormshield.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "stormshield.logtype", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "stormshield.logtype", + "negate": false, + "params": { + "query": "web" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "stormshield.logtype": "web" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4cf8b022-4f49-5427-a501-ded71348a873", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "4cf8b022-4f49-5427-a501-ded71348a873": { + "columnOrder": [ + "6336a0a3-b270-5fde-bf94-89b72e542189", + "a0ed95b3-fb9f-5918-b2ea-2e6230cf540b", + "0480dab6-f9da-5f79-a3e3-bbacbc58d29b" + ], + "columns": { + "6336a0a3-b270-5fde-bf94-89b72e542189": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "0480dab6-f9da-5f79-a3e3-bbacbc58d29b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "a0ed95b3-fb9f-5918-b2ea-2e6230cf540b": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of http.response.status_code", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0480dab6-f9da-5f79-a3e3-bbacbc58d29b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "http.response.status_code" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0480dab6-f9da-5f79-a3e3-bbacbc58d29b" + ], + "layerId": "4cf8b022-4f49-5427-a501-ded71348a873", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "6336a0a3-b270-5fde-bf94-89b72e542189", + "splitAccessor": "a0ed95b3-fb9f-5918-b2ea-2e6230cf540b" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Web events over time", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "a3546d57-226a-5afb-8c4c-9f5a9ef6f773", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "a3546d57-226a-5afb-8c4c-9f5a9ef6f773", + "title": "Web events over time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2d9622c1-f301-59ed-b170-6f38003a569b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2d9622c1-f301-59ed-b170-6f38003a569b": { + "columnOrder": [ + "a8516a56-c675-51f0-b066-38eb7a7ed231" + ], + "columns": { + "a8516a56-c675-51f0-b066-38eb7a7ed231": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "2d9622c1-f301-59ed-b170-6f38003a569b", + "layerType": "data", + "metricAccessor": "a8516a56-c675-51f0-b066-38eb7a7ed231" + } + }, + "title": "Web event count", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} + }, + "gridData": { + "h": 9, + "i": "7016f62b-3da9-5cd3-ae3a-0691441c9112", + "w": 8, + "x": 24, + "y": 0 + }, + "panelIndex": "7016f62b-3da9-5cd3-ae3a-0691441c9112", + "type": "lens", + "title": "Web event count" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2e320b81-d82f-5d45-9472-3537c63bc4d5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "2e320b81-d82f-5d45-9472-3537c63bc4d5": { + "columnOrder": [ + "27f603bc-c291-5200-a560-b004ecc14bed", + "e14c226c-b554-5aa1-9d88-49476efd770b" + ], + "columns": { + "e14c226c-b554-5aa1-9d88-49476efd770b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "27f603bc-c291-5200-a560-b004ecc14bed": { + "dataType": "string", + "isBucketed": true, + "label": "Top 8 values of http.response.status_code", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e14c226c-b554-5aa1-9d88-49476efd770b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 8 + }, + "scale": "ordinal", + "sourceField": "http.response.status_code" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2e320b81-d82f-5d45-9472-3537c63bc4d5", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "e14c226c-b554-5aa1-9d88-49476efd770b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "27f603bc-c291-5200-a560-b004ecc14bed" + ] + } + ], + "shape": "donut" + } + }, + "title": "HTTP status codes", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "127461bd-2673-5459-9990-df8b322be80e", + "w": 16, + "x": 32, + "y": 0 + }, + "panelIndex": "127461bd-2673-5459-9990-df8b322be80e", + "title": "HTTP status codes", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5c1393f2-1f7a-56e4-9af3-bb7d6ff9617e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "5c1393f2-1f7a-56e4-9af3-bb7d6ff9617e": { + "columnOrder": [ + "5cefafa8-90f8-5920-8c80-0babb7b54287", + "66efea6c-d506-597c-9d32-0bd9fd6cf300" + ], + "columns": { + "66efea6c-d506-597c-9d32-0bd9fd6cf300": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5cefafa8-90f8-5920-8c80-0babb7b54287": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of url.domain", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "66efea6c-d506-597c-9d32-0bd9fd6cf300", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "url.domain" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "5c1393f2-1f7a-56e4-9af3-bb7d6ff9617e", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "66efea6c-d506-597c-9d32-0bd9fd6cf300" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "5cefafa8-90f8-5920-8c80-0babb7b54287" + ] + } + ], + "shape": "donut" + } + }, + "title": "Top domains", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "4e97f0cf-dce6-512c-acf4-f2919e2f0f06", + "w": 12, + "x": 0, + "y": 9 + }, + "panelIndex": "4e97f0cf-dce6-512c-acf4-f2919e2f0f06", + "title": "Top domains", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8699fe67-021d-5a6d-96a6-ad4f4bd0db5a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "8699fe67-021d-5a6d-96a6-ad4f4bd0db5a": { + "columnOrder": [ + "81886e35-c925-5383-97a8-111beb35307d", + "7b8b5a1b-9911-5b4d-8ef1-e6b22a390482" + ], + "columns": { + "7b8b5a1b-9911-5b4d-8ef1-e6b22a390482": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "81886e35-c925-5383-97a8-111beb35307d": { + "dataType": "string", + "isBucketed": true, + "label": "Top 8 values of http.request.method", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7b8b5a1b-9911-5b4d-8ef1-e6b22a390482", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 8 + }, + "scale": "ordinal", + "sourceField": "http.request.method" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "8699fe67-021d-5a6d-96a6-ad4f4bd0db5a", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "7b8b5a1b-9911-5b4d-8ef1-e6b22a390482" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "81886e35-c925-5383-97a8-111beb35307d" + ] + } + ], + "shape": "donut" + } + }, + "title": "HTTP methods", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "0bc81e68-192a-5773-8224-a23e596cea29", + "w": 12, + "x": 12, + "y": 9 + }, + "panelIndex": "0bc81e68-192a-5773-8224-a23e596cea29", + "title": "HTTP methods", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-32f2599f-dd11-5ceb-811e-4e5fed442c13", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "32f2599f-dd11-5ceb-811e-4e5fed442c13": { + "columnOrder": [ + "ccd9c389-866e-5efe-bf1e-a3b1c07aa910", + "62107dcb-b983-500f-8dd7-6549e22bfd20" + ], + "columns": { + "62107dcb-b983-500f-8dd7-6549e22bfd20": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ccd9c389-866e-5efe-bf1e-a3b1c07aa910": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of user.name", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "62107dcb-b983-500f-8dd7-6549e22bfd20", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "32f2599f-dd11-5ceb-811e-4e5fed442c13", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "62107dcb-b983-500f-8dd7-6549e22bfd20" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ccd9c389-866e-5efe-bf1e-a3b1c07aa910" + ] + } + ], + "shape": "donut" + } + }, + "title": "Top users", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "31be951d-1f72-5486-b40a-83a1d6f8f9c8", + "w": 12, + "x": 24, + "y": 9 + }, + "panelIndex": "31be951d-1f72-5486-b40a-83a1d6f8f9c8", + "title": "Top users", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ebe23361-991f-55a4-824c-96ffdcbbb51f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "ebe23361-991f-55a4-824c-96ffdcbbb51f": { + "columnOrder": [ + "b391aa03-645b-5ee6-ab48-eed349a2f8c0", + "0fc8730f-af2d-5bf6-9493-391eab61b93b" + ], + "columns": { + "0fc8730f-af2d-5bf6-9493-391eab61b93b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b391aa03-645b-5ee6-ab48-eed349a2f8c0": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of stormshield.metadata.cat_site", + "customLabel": false, + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0fc8730f-af2d-5bf6-9493-391eab61b93b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "stormshield.metadata.cat_site" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "ebe23361-991f-55a4-824c-96ffdcbbb51f", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "0fc8730f-af2d-5bf6-9493-391eab61b93b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "b391aa03-645b-5ee6-ab48-eed349a2f8c0" + ] + } + ], + "shape": "donut" + } + }, + "title": "Site categories", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "45ce798e-8c17-55ec-8675-c61bdf8a8b62", + "w": 12, + "x": 36, + "y": 9 + }, + "panelIndex": "45ce798e-8c17-55ec-8675-c61bdf8a8b62", + "title": "Site categories", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-127a9a34-beb0-5b4e-a136-5bf0e9c1a492", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "127a9a34-beb0-5b4e-a136-5bf0e9c1a492": { + "columnOrder": [ + "a7eea2fd-2c95-557a-b36a-be4b22f93ea2", + "7b7d82dc-f1ea-58a4-976e-831c2fff3bc7", + "0155e979-18bd-5c09-862a-20e7349f660e" + ], + "columns": { + "a7eea2fd-2c95-557a-b36a-be4b22f93ea2": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "7b7d82dc-f1ea-58a4-976e-831c2fff3bc7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Sent", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "source.bytes" + }, + "0155e979-18bd-5c09-862a-20e7349f660e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Received", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "destination.bytes" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "7b7d82dc-f1ea-58a4-976e-831c2fff3bc7", + "0155e979-18bd-5c09-862a-20e7349f660e" + ], + "layerId": "127a9a34-beb0-5b4e-a136-5bf0e9c1a492", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "a7eea2fd-2c95-557a-b36a-be4b22f93ea2" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Web traffic bytes over time", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "daa5e405-c53a-50e4-ae31-d5c3fcb7fb72", + "w": 48, + "x": 0, + "y": 18 + }, + "panelIndex": "daa5e405-c53a-50e4-ae31-d5c3fcb7fb72", + "title": "Web traffic bytes over time", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Stormshield SNS] Web Activity", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "id": "stormshield-bf67b6e6-d546-5d7b-9dde-5815fe21da2b", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a3546d57-226a-5afb-8c4c-9f5a9ef6f773:indexpattern-datasource-layer-4cf8b022-4f49-5427-a501-ded71348a873", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7016f62b-3da9-5cd3-ae3a-0691441c9112:indexpattern-datasource-layer-2d9622c1-f301-59ed-b170-6f38003a569b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "127461bd-2673-5459-9990-df8b322be80e:indexpattern-datasource-layer-2e320b81-d82f-5d45-9472-3537c63bc4d5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4e97f0cf-dce6-512c-acf4-f2919e2f0f06:indexpattern-datasource-layer-5c1393f2-1f7a-56e4-9af3-bb7d6ff9617e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0bc81e68-192a-5773-8224-a23e596cea29:indexpattern-datasource-layer-8699fe67-021d-5a6d-96a6-ad4f4bd0db5a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "31be951d-1f72-5486-b40a-83a1d6f8f9c8:indexpattern-datasource-layer-32f2599f-dd11-5ceb-811e-4e5fed442c13", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45ce798e-8c17-55ec-8675-c61bdf8a8b62:indexpattern-datasource-layer-ebe23361-991f-55a4-824c-96ffdcbbb51f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "daa5e405-c53a-50e4-ae31-d5c3fcb7fb72:indexpattern-datasource-layer-127a9a34-beb0-5b4e-a136-5bf0e9c1a492", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "8.9.0" +} diff --git a/packages/stormshield/manifest.yml b/packages/stormshield/manifest.yml index 3b85c8ff526..a9fdf2dfcfa 100644 --- a/packages/stormshield/manifest.yml +++ b/packages/stormshield/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.1.1 name: stormshield title: "StormShield SNS" -version: "1.5.2" +version: "1.8.0" source: license: "Elastic-2.0" description: "Stormshield SNS integration." @@ -10,7 +10,6 @@ categories: - network - security - firewall_security - # Added network_security category as Stormshield provides network security protection - network_security conditions: kibana: @@ -26,9 +25,25 @@ screenshots: title: SNS Configuration Syslog size: 1296x717 type: image/png - - src: /img/dashboard.png - title: SNS dashboard Overview - size: 1078x1441 + - src: /img/stormshield-sns-overview.png + title: SNS Overview dashboard + size: 3200x3096 + type: image/png + - src: /img/stormshield-sns-alarms.png + title: SNS Alarms (IPS) dashboard + size: 3200x1584 + type: image/png + - src: /img/stormshield-sns-network-traffic.png + title: SNS Network Traffic dashboard + size: 3200x1528 + type: image/png + - src: /img/stormshield-sns-web-activity.png + title: SNS Web Activity dashboard + size: 3200x2600 + type: image/png + - src: /img/stormshield-sns-users-vpn.png + title: SNS Users and VPN dashboard + size: 3200x1528 type: image/png icons: - src: /img/stormshield_logo.png