Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set event.outcome based on googlecloud audit log output #15731

Merged
merged 12 commits into from
Jan 23, 2020
Merged

Set event.outcome based on googlecloud audit log output #15731

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
175b3db
Add ssl config to input.yml for Filebeat httpjson input
Nov 23, 2019
ca7c209
Merge branch 'master' of github.com:alakahakai/beats
Nov 25, 2019
fb51e96
Fix CHANGELOG.next.asciidoc
Nov 25, 2019
b4ca35b
Merge remote-tracking branch 'upstream/master'
Dec 11, 2019
42fd2bd
Merge branch 'master' of github.com:alakahakai/beats
Dec 11, 2019
3148c64
Fix merge problems
Dec 11, 2019
df52d77
Merge remote-tracking branch 'upstream/master'
Dec 19, 2019
445ca3d
Merge remote-tracking branch 'upstream/master'
Jan 7, 2020
30a59fd
Merge remote-tracking branch 'upstream/master'
Jan 22, 2020
6de44ce
Set event.outcome based on googlecloud audit log output
Jan 22, 2020
a363763
Update CHANGELOG.next.asciidoc
Jan 22, 2020
a84cfc9
Fix some problems according to review comments
Jan 23, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ TLS or Beats that accept connections over TLS and validate client certificates.


*Filebeat*

- Set event.outcome field based on googlecloud audit log output. {pull}15731[15731]

*Heartbeat*

Expand Down
23 changes: 23 additions & 0 deletions x-pack/filebeat/module/googlecloud/audit/config/pipeline.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,28 @@ function Audit(keep_original_message) {
}
};

// Set event.outcome based on authenticatio_info and status
alakahakai marked this conversation as resolved.
Show resolved Hide resolved
var setEventOutcome = function(evt) {
if (evt.Get("googlecloud.audit.status.code") == null) {
var authorization_info = evt.Get("googlecloud.audit.authorization_info");
if (authorization_info.length == 1) {
if (authorization_info[0].granted == null) {
evt.Put("event.outcome", "unknown");
} else if (authorization_info[0].granted == true) {
alakahakai marked this conversation as resolved.
Show resolved Hide resolved
evt.Put("event.outcome", "success");
} else {
evt.Put("event.outcome", "failure");
}
} else {
evt.Put("event.outcome", "unknown");
}
} else if (evt.Get("googlecloud.audit.status.code") == 0) {
evt.Put("event.outcome", "success");
alakahakai marked this conversation as resolved.
Show resolved Hide resolved
} else {
evt.Put("event.outcome", "failure");
}
};

var pipeline = new processor.Chain()
.Add(decodeJson)
.Add(parseTimestamp)
Expand All @@ -135,6 +157,7 @@ function Audit(keep_original_message) {
.Add(copyFields)
.Add(dropExtraFields)
.Add(RenameNestedFields)
.Add(setEventOutcome)
.Build();

return {
Expand Down
3 changes: 2 additions & 1 deletion x-pack/filebeat/module/googlecloud/audit/test/audit-log-entries.json.log
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
{"insertId":"-uihnmjctwo","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"[email protected]"},"authorizationInfo":[{"granted":true,"permission":"resourcemanager.projects.get","resource":"projects/elastic-beats","resourceAttributes":{}}],"methodName":"GetResourceBillingInfo","request":{"@type":"type.googleapis.com/google.internal.cloudbilling.billingaccount.v1.GetResourceBillingInfoRequest","resourceName":"projects/189716325846"},"requestMetadata":{"callerIp":"192.168.1.1","destinationAttributes":{},"requestAttributes":{}},"resourceName":"projects/elastic-beats","serviceName":"cloudbilling.googleapis.com","status":{}},"receiveTimestamp":"2019-12-19T00:49:36.313482371Z","resource":{"labels":{"project_id":"elastic-beats"},"type":"project"},"severity":"INFO","timestamp":"2019-12-19T00:49:36.086Z"}
{"insertId":"-h6onuze1h7dg","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"[email protected]"},"authorizationInfo":[{"granted":true,"permission":"compute.machineTypes.list","resourceAttributes":{"name":"projects/elastic-beats","service":"resourcemanager","type":"resourcemanager.projects"}}],"methodName":"beta.compute.machineTypes.aggregatedList","numResponseItems":"71","request":{"@type":"type.googleapis.com/compute.machineTypes.aggregatedList"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2019-12-19T00:45:51.711Z"}},"resourceLocation":{"currentLocations":["global"]},"resourceName":"projects/elastic-beats/global/machineTypes","serviceName":"compute.googleapis.com"},"receiveTimestamp":"2019-12-19T00:45:52.367887078Z","resource":{"labels":{"location":"global","method":"compute.machineTypes.aggregatedList","project_id":"elastic-beats","service":"compute.googleapis.com","version":"beta"},"type":"api"},"severity":"INFO","timestamp":"2019-12-19T00:45:51.228Z"}
{"insertId":"-h6onuze1h7dg","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"[email protected]"},"authorizationInfo":[{"granted":false,"permission":"compute.machineTypes.list","resourceAttributes":{"name":"projects/elastic-beats","service":"resourcemanager","type":"resourcemanager.projects"}}],"methodName":"beta.compute.machineTypes.aggregatedList","numResponseItems":"71","request":{"@type":"type.googleapis.com/compute.machineTypes.aggregatedList"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2019-12-19T00:45:51.711Z"}},"resourceLocation":{"currentLocations":["global"]},"resourceName":"projects/elastic-beats/global/machineTypes","serviceName":"compute.googleapis.com"},"receiveTimestamp":"2019-12-19T00:45:52.367887078Z","resource":{"labels":{"location":"global","method":"compute.machineTypes.aggregatedList","project_id":"elastic-beats","service":"compute.googleapis.com","version":"beta"},"type":"api"},"severity":"INFO","timestamp":"2019-12-19T00:45:51.228Z"}
{"insertId":"yonau2dg2zi","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"[email protected]"},"authorizationInfo":[{"granted":true,"permission":"compute.instances.list","resourceAttributes":{"name":"projects/elastic-beats","service":"resourcemanager","type":"resourcemanager.projects"}}],"methodName":"beta.compute.instances.aggregatedList","numResponseItems":"61","request":{"@type":"type.googleapis.com/compute.instances.aggregatedList"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2019-12-19T00:44:25.198Z"}},"resourceLocation":{"currentLocations":["global"]},"resourceName":"projects/elastic-beats/global/instances","serviceName":"compute.googleapis.com"},"receiveTimestamp":"2019-12-19T00:44:25.262379373Z","resource":{"labels":{"location":"global","method":"compute.instances.aggregatedList","project_id":"elastic-beats","service":"compute.googleapis.com","version":"beta"},"type":"api"},"severity":"INFO","timestamp":"2019-12-19T00:44:25.051Z"}
{"insertId":"yonau3dc2zi","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"[email protected]"},"authorizationInfo":[{"permission":"compute.instances.list","resourceAttributes":{"name":"projects/elastic-beats","service":"resourcemanager","type":"resourcemanager.projects"}}],"methodName":"beta.compute.instances.aggregatedList","numResponseItems":"61","request":{"@type":"type.googleapis.com/compute.instances.aggregatedList"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2019-12-19T00:44:25.198Z"}},"resourceLocation":{"currentLocations":["global"]},"resourceName":"projects/elastic-beats/global/instances","serviceName":"compute.googleapis.com","status":{"code":7,"message":"PERMISSION_DENIED"}},"receiveTimestamp":"2019-12-19T00:44:25.262379373Z","resource":{"labels":{"location":"global","method":"compute.instances.aggregatedList","project_id":"elastic-beats","service":"compute.googleapis.com","version":"beta"},"type":"api"},"severity":"INFO","timestamp":"2019-12-19T00:44:25.051Z"}
53 changes: 51 additions & 2 deletions x-pack/filebeat/module/googlecloud/audit/test/audit-log-entries.json.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
"cloud.project.id": "elastic-beats",
"event.dataset": "googlecloud.audit",
"event.module": "googlecloud",
"event.outcome": "success",
"fileset.name": "audit",
"googlecloud.audit.authentication_info.principal_email": "[email protected]",
"googlecloud.audit.authorization_info": [
Expand Down Expand Up @@ -34,11 +35,12 @@
"cloud.project.id": "elastic-beats",
"event.dataset": "googlecloud.audit",
"event.module": "googlecloud",
"event.outcome": "failure",
"fileset.name": "audit",
"googlecloud.audit.authentication_info.principal_email": "[email protected]",
"googlecloud.audit.authorization_info": [
{
"granted": true,
"granted": false,
"permission": "compute.machineTypes.list",
"resource_attributes": {
"name": "projects/elastic-beats",
Expand Down Expand Up @@ -78,6 +80,7 @@
"cloud.project.id": "elastic-beats",
"event.dataset": "googlecloud.audit",
"event.module": "googlecloud",
"event.outcome": "success",
"fileset.name": "audit",
"googlecloud.audit.authentication_info.principal_email": "[email protected]",
"googlecloud.audit.authorization_info": [
Expand All @@ -104,7 +107,53 @@
"googlecloud.audit.type": "type.googleapis.com/google.cloud.audit.AuditLog",
"input.type": "log",
"log.logger": "projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access",
"log.offset": 2251,
"log.offset": 2252,
"service.name": "compute.googleapis.com",
"service.type": "googlecloud",
"source.ip": "192.168.1.1",
"user.email": "[email protected]",
"user_agent.device.name": "Other",
"user_agent.name": "Firefox",
"user_agent.original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)",
"user_agent.os.full": "Mac OS X 10.15",
"user_agent.os.name": "Mac OS X",
"user_agent.os.version": "10.15",
"user_agent.version": "71.0."
},
{
"@timestamp": "2019-12-19T00:44:25.051Z",
"cloud.project.id": "elastic-beats",
"event.dataset": "googlecloud.audit",
"event.module": "googlecloud",
"event.outcome": "failure",
"fileset.name": "audit",
"googlecloud.audit.authentication_info.principal_email": "[email protected]",
"googlecloud.audit.authorization_info": [
{
"permission": "compute.instances.list",
"resource_attributes": {
"name": "projects/elastic-beats",
"service": "resourcemanager",
"type": "resourcemanager.projects"
}
}
],
"googlecloud.audit.method_name": "beta.compute.instances.aggregatedList",
"googlecloud.audit.num_response_items": 61,
"googlecloud.audit.request.proto_name": "type.googleapis.com/compute.instances.aggregatedList",
"googlecloud.audit.request_metadata.caller_ip": "192.168.1.1",
"googlecloud.audit.request_metadata.caller_supplied_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)",
"googlecloud.audit.resource_location.current_locations": [
"global"
],
"googlecloud.audit.resource_name": "projects/elastic-beats/global/instances",
"googlecloud.audit.service_name": "compute.googleapis.com",
"googlecloud.audit.status.code": 7,
"googlecloud.audit.status.message": "PERMISSION_DENIED",
"googlecloud.audit.type": "type.googleapis.com/google.cloud.audit.AuditLog",
"input.type": "log",
"log.logger": "projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access",
"log.offset": 3541,
"service.name": "compute.googleapis.com",
"service.type": "googlecloud",
"source.ip": "192.168.1.1",
Expand Down