Skip to content

Commit fc1bfbe

Browse files
legoguy1000legoguy1000
authored
[AWS] Support Cloudtrail tlsDetails field (#6352)
1 parent ac65b43 commit fc1bfbe

File tree

7 files changed

+130
-1
lines changed

7 files changed

+130
-1
lines changed

‎packages/aws/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.5.0"
3+
changes:
4+
- description: Update Cloudtrail datastream to support tlsDetails field
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/6352
27
- version: "2.4.1"
38
changes:
49
- description: Fix Security Hub Findings to abide by ECS allowed values.

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"eventVersion":"1.05","userIdentity":{"type":"IAMUser","principalId":"EXAMPLE_ID","arn":"arn:aws:iam::0123456789012:user/Alice","accountId":"0123456789012","accessKeyId":"EXAMPLE_KEY","userName":"Alice","sessionContext":{"attributes":{"mfaAuthenticated":"true","creationDate":"2020-01-10T14:38:30Z"}},"invokedBy":"signin.amazonaws.com"},"eventTime":"2020-01-10T16:06:40Z","eventSource":"iam.amazonaws.com","eventName":"UploadSSHPublicKey","awsRegion":"us-east-1","sourceIPAddress":"127.0.0.1","userAgent":"signin.amazonaws.com","requestParameters":{"sSHPublicKeyBody":"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain","userName":"Alice"},"responseElements":{"sSHPublicKey":{"fingerprint":"de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de","status":"Active","uploadDate":"Jan 10, 2020 4:06:40 PM","userName":"Alice","sSHPublicKeyId":"EXAMPLE_KEY_ID","sSHPublicKeyBody":"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain"}},"requestID":"EXAMPLE-44b9-41cd-90f2-EXAMPLE","eventID":"EXAMPLE-9a9d-4da4-9998-EXAMPLE","eventType":"AwsApiCall","recipientAccountId":"0123456789012","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"ECDHE-RSA-AES128-GCM-SHA256","clientProvidedHostHeader":"ssm.us-west-2.amazonaws.com"}}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2020-01-10T16:06:40.000Z",
5+
"aws": {
6+
"cloudtrail": {
7+
"event_type": "AwsApiCall",
8+
"event_version": "1.05",
9+
"flattened": {
10+
"request_parameters": {
11+
"sSHPublicKeyBody": "ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain",
12+
"userName": "Alice"
13+
},
14+
"response_elements": {
15+
"sSHPublicKey": {
16+
"fingerprint": "de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de",
17+
"sSHPublicKeyBody": "ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain",
18+
"sSHPublicKeyId": "EXAMPLE_KEY_ID",
19+
"status": "Active",
20+
"uploadDate": "Jan 10, 2020 4:06:40 PM",
21+
"userName": "Alice"
22+
}
23+
}
24+
},
25+
"recipient_account_id": "0123456789012",
26+
"request_id": "EXAMPLE-44b9-41cd-90f2-EXAMPLE",
27+
"request_parameters": "{sSHPublicKeyBody=ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain, userName=Alice}",
28+
"response_elements": "{sSHPublicKey={sSHPublicKeyBody=ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain, sSHPublicKeyId=EXAMPLE_KEY_ID, uploadDate=Jan 10, 2020 4:06:40 PM, fingerprint=de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de, userName=Alice, status=Active}}",
29+
"user_identity": {
30+
"access_key_id": "EXAMPLE_KEY",
31+
"arn": "arn:aws:iam::0123456789012:user/Alice",
32+
"invoked_by": "signin.amazonaws.com",
33+
"session_context": {
34+
"creation_date": "2020-01-10T14:38:30.000Z",
35+
"mfa_authenticated": "true"
36+
},
37+
"type": "IAMUser"
38+
}
39+
}
40+
},
41+
"cloud": {
42+
"account": {
43+
"id": "0123456789012"
44+
},
45+
"region": "us-east-1"
46+
},
47+
"ecs": {
48+
"version": "8.0.0"
49+
},
50+
"event": {
51+
"action": "UploadSSHPublicKey",
52+
"created": "2021-11-11T01:02:03.123456789Z",
53+
"id": "EXAMPLE-9a9d-4da4-9998-EXAMPLE",
54+
"kind": "event",
55+
"original": "{\"eventVersion\":\"1.05\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"EXAMPLE_ID\",\"arn\":\"arn:aws:iam::0123456789012:user/Alice\",\"accountId\":\"0123456789012\",\"accessKeyId\":\"EXAMPLE_KEY\",\"userName\":\"Alice\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"true\",\"creationDate\":\"2020-01-10T14:38:30Z\"}},\"invokedBy\":\"signin.amazonaws.com\"},\"eventTime\":\"2020-01-10T16:06:40Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"UploadSSHPublicKey\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"signin.amazonaws.com\",\"requestParameters\":{\"sSHPublicKeyBody\":\"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain\",\"userName\":\"Alice\"},\"responseElements\":{\"sSHPublicKey\":{\"fingerprint\":\"de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de\",\"status\":\"Active\",\"uploadDate\":\"Jan 10, 2020 4:06:40 PM\",\"userName\":\"Alice\",\"sSHPublicKeyId\":\"EXAMPLE_KEY_ID\",\"sSHPublicKeyBody\":\"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain\"}},\"requestID\":\"EXAMPLE-44b9-41cd-90f2-EXAMPLE\",\"eventID\":\"EXAMPLE-9a9d-4da4-9998-EXAMPLE\",\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"0123456789012\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.2\",\"cipherSuite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"clientProvidedHostHeader\":\"ssm.us-west-2.amazonaws.com\"}}",
56+
"outcome": "success",
57+
"provider": "iam.amazonaws.com",
58+
"type": "info"
59+
},
60+
"related": {
61+
"user": [
62+
"Alice"
63+
]
64+
},
65+
"source": {
66+
"address": "127.0.0.1",
67+
"ip": "127.0.0.1"
68+
},
69+
"tags": [
70+
"preserve_original_event"
71+
],
72+
"tls": {
73+
"cipher": "ECDHE-RSA-AES128-GCM-SHA256",
74+
"client": {
75+
"server_name": "ssm.us-west-2.amazonaws.com"
76+
},
77+
"version": "1.2",
78+
"version_protocol": "tls"
79+
},
80+
"user": {
81+
"id": "EXAMPLE_ID",
82+
"name": "Alice",
83+
"target": {
84+
"name": "Alice"
85+
}
86+
},
87+
"user_agent": {
88+
"device": {
89+
"name": "Other"
90+
},
91+
"name": "Other",
92+
"original": "signin.amazonaws.com"
93+
}
94+
}
95+
]
96+
}

‎packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -743,6 +743,21 @@ processors:
743743
field: aws.cloudtrail.insight_details
744744
target_field: aws.cloudtrail.flattened.insight_details
745745
ignore_missing: true
746+
- dissect:
747+
field: json.tlsDetails.tlsVersion
748+
pattern: "%{tls.version_protocol}v%{tls.version}"
749+
ignore_missing: true
750+
- lowercase:
751+
field: tls.version_protocol
752+
ignore_missing: true
753+
- rename:
754+
field: json.tlsDetails.cipherSuite
755+
target_field: tls.cipher
756+
ignore_missing: true
757+
- rename:
758+
field: json.tlsDetails.clientProvidedHostHeader
759+
target_field: tls.client.server_name
760+
ignore_missing: true
746761
- remove:
747762
field: json
748763
ignore_missing: true

‎packages/aws/data_stream/cloudtrail/fields/ecs.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,3 +134,11 @@
134134
name: container.labels
135135
- external: ecs
136136
name: container.name
137+
- external: ecs
138+
name: tls.version
139+
- external: ecs
140+
name: tls.version_protocol
141+
- external: ecs
142+
name: tls.cipher
143+
- external: ecs
144+
name: tls.client.server_name

‎packages/aws/docs/cloudtrail.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,10 @@ If blank, CloudTrail Digest logs will be skipped.
186186
| source.geo.region_name | Region name. | keyword |
187187
| source.ip | IP address of the source (IPv4 or IPv6). | ip |
188188
| tags | List of keywords used to tag each event. | keyword |
189+
| tls.cipher | String indicating the cipher used during the current connection. | keyword |
190+
| tls.client.server_name | Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`. | keyword |
191+
| tls.version | Numeric part of the version parsed from the original string. | keyword |
192+
| tls.version_protocol | Normalized lowercase protocol name parsed from original string. | keyword |
189193
| user.changes.name | Short name or login of the user. | keyword |
190194
| user.changes.name.text | Multi-field of `user.changes.name`. | match_only_text |
191195
| user.id | Unique identifier of the user. | keyword |

‎packages/aws/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 1.0.0
22
name: aws
33
title: AWS
4-
version: 2.4.1
4+
version: 2.5.0
55
license: basic
66
description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
77
type: integration

0 commit comments

Comments
 (0)