Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cyberark Privileged Access Security module #24803

Merged
merged 102 commits into from
Apr 19, 2021
Merged

Cyberark Privileged Access Security module #24803

merged 102 commits into from
Apr 19, 2021

Commits on Apr 19, 2021

  1. Cyberarkpas module skeleton

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    1da5826 View commit details
    Browse the repository at this point in the history

  2. Save Cyberark transform XSLT file

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    599b7aa View commit details
    Browse the repository at this point in the history

  3. XSL: Escape some control characters 

    Technically it should escape all control characters (0-0x1f) but
I can't find a way to do that in XSLT v1.0. Only TAB, CR and LF
can be represented.
    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    c6d2ac0 View commit details
    Browse the repository at this point in the history

  4. Mage update

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    79c4752 View commit details
    Browse the repository at this point in the history

  5. WIP

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    f94039e View commit details
    Browse the repository at this point in the history

  6. proper failure modes

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    6152e86 View commit details
    Browse the repository at this point in the history

  7. Cleanup temp fields on failure

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    c505016 View commit details
    Browse the repository at this point in the history

  8. Set event.code

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    8174cf7 View commit details
    Browse the repository at this point in the history

  9. Debug: Add raw key to JSON

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    e25ed29 View commit details
    Browse the repository at this point in the history

  10. Save raw fields

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    e17d706 View commit details
    Browse the repository at this point in the history

  11. Initial test data

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    43bb357 View commit details
    Browse the repository at this point in the history

  12. add samples from Cyberark

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    1d44d3a View commit details
    Browse the repository at this point in the history

  13. Transform CAProperties to an object

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    8020472 View commit details
    Browse the repository at this point in the history

  14. Remove empty fields

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    5df1836 View commit details
    Browse the repository at this point in the history

  15. Fix missing timestamp in log

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    2895edd View commit details
    Browse the repository at this point in the history

  16. Split ExtraDetails key/values

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    28f34c0 View commit details
    Browse the repository at this point in the history

  17. Convert fields to snake_case

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    e380166 View commit details
    Browse the repository at this point in the history

  18. Make population of ExtraDetails more efficient 

    No need to create a copy.
    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    99249be View commit details
    Browse the repository at this point in the history

  19. CAProperties values as array is unnecessary

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    f14e3af View commit details
    Browse the repository at this point in the history

  20. Improve @timestamp calculation

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    e91ab8b View commit details
    Browse the repository at this point in the history

  21. Remove empty fields faster

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    950285e View commit details
    Browse the repository at this point in the history

  22. small cleanup

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    09ab3a5 View commit details
    Browse the repository at this point in the history

  23. Populate source.address/.ip/.domain

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    558d37f View commit details
    Browse the repository at this point in the history

  24. Populate observer fields

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    f75e411 View commit details
    Browse the repository at this point in the history

  25. Populate destination.address and related.ip

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    9e8d1af View commit details
    Browse the repository at this point in the history

  26. Enrich events by message ID

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    3d9f2e2 View commit details
    Browse the repository at this point in the history

  27. Support logon/logoff/full gateway connection

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    f788eeb View commit details
    Browse the repository at this point in the history

  28. Support 22 - Verify Password

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    fa865e0 View commit details
    Browse the repository at this point in the history

  29. Save message (temporary?)

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    3f0e931 View commit details
    Browse the repository at this point in the history

  30. event severity/type/action and corrections

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    a0a0011 View commit details
    Browse the repository at this point in the history

  31. Set event.type: error for errors

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    9361652 View commit details
    Browse the repository at this point in the history

  32. message_id: 4 -- User authentication failure

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    b1e2c3c View commit details
    Browse the repository at this point in the history

  33. 24 - CPM Change password

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    40578d5 View commit details
    Browse the repository at this point in the history

  34. Correct event.type as an array

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    322cf7e View commit details
    Browse the repository at this point in the history

  35. 31 - CPM Reconcile Password (unsure) 

    Needs review
    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    f865a86 View commit details
    Browse the repository at this point in the history

  36. 32 - Add Owner to Safe

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    6067668 View commit details
    Browse the repository at this point in the history

  37. 33 - Same as 32

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    2e2b93e View commit details
    Browse the repository at this point in the history

  38. 38 - CPM Verify Password failed

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    68b00e2 View commit details
    Browse the repository at this point in the history

  39. small cleanup

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    77de899 View commit details
    Browse the repository at this point in the history

  40. Populate related.user

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    2c04a9e View commit details
    Browse the repository at this point in the history

  41. Refactor enrichment processor entries

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    3367e5a View commit details
    Browse the repository at this point in the history

  42. Use event.reason instead of error.message

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    cefa95d View commit details
    Browse the repository at this point in the history

  43. temporary comment

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    27fed9a View commit details
    Browse the repository at this point in the history

  44. 60 - CPM Reconcile Password Failed

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    13c8e31 View commit details
    Browse the repository at this point in the history

  45. 130 - CPM Disable Password

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    16656a8 View commit details
    Browse the repository at this point in the history

  46. s/failed/failure/g

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    e069684 View commit details
    Browse the repository at this point in the history

  47. 295 - Retrieve Password succeeded

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    eb8416f View commit details
    Browse the repository at this point in the history

  48. 300 - PSM Connect

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    86468c8 View commit details
    Browse the repository at this point in the history

  49. 302 - PSM Disconnect

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    f3618c6 View commit details
    Browse the repository at this point in the history

  50. 300 - PSM Connect

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    ae9b0bc View commit details
    Browse the repository at this point in the history

  51. 308 - Use Password

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    5818216 View commit details
    Browse the repository at this point in the history

  52. 361 - Keystroke Logging

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    59136b3 View commit details
    Browse the repository at this point in the history

  53. Don't populate observer.hostname unless present.

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    32fbbee View commit details
    Browse the repository at this point in the history

  54. 411 - Window Title

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    1efdca2 View commit details
    Browse the repository at this point in the history

  55. Use event.timezone for syslog timestamp

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    0215811 View commit details
    Browse the repository at this point in the history

  56. Set pipeline_error on error

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    5125c17 View commit details
    Browse the repository at this point in the history

  57. set user.name from source.user.name 

    When source and destination user names are used, user.name should also
be populated with the user performing the action.
    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    51520f2 View commit details
    Browse the repository at this point in the history

  58. 414 - CPM Verify SSH Key

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    1ff264f View commit details
    Browse the repository at this point in the history

  59. 428 - Retrive SSH Key

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    ed90394 View commit details
    Browse the repository at this point in the history

  60. 57 - CPM Change Password Failed

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    55ee830 View commit details
    Browse the repository at this point in the history

  61. 309 - Undefined User Logon

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    bae9ff2 View commit details
    Browse the repository at this point in the history

  62. 359 - SQL Command / network.protocol to application

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    74957b5 View commit details
    Browse the repository at this point in the history

  63. Remove known unknowns

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    8ba68ae View commit details
    Browse the repository at this point in the history

  64. Configuration with TLS support

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    e78a7cb View commit details
    Browse the repository at this point in the history

  65. Fix

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    db134ee View commit details
    Browse the repository at this point in the history

  66. Make update

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    0836391 View commit details
    Browse the repository at this point in the history

  67. 412 - Keystroke logging (cloned from 361)

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    eb0eb5d View commit details
    Browse the repository at this point in the history

  68. Remove comment

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    546fed6 View commit details
    Browse the repository at this point in the history

  69. Keep event.original if flag is set

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    c50242b View commit details
    Browse the repository at this point in the history

  70. Missing file

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    cc0b7d7 View commit details
    Browse the repository at this point in the history

  71. Add geoip processors

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    81f91ef View commit details
    Browse the repository at this point in the history

  72. Define explicit fields instead of using flattened

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    a32e95c View commit details
    Browse the repository at this point in the history

  73. Alternative population of Hostname field

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    953693d View commit details
    Browse the repository at this point in the history

  74. Sample dashboard

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    6a0e481 View commit details
    Browse the repository at this point in the history

  75. Docs

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    f1d7b84 View commit details
    Browse the repository at this point in the history

  76. Update docs

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    ad79790 View commit details
    Browse the repository at this point in the history

  77. Document preserve_original_event flag

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    f026c60 View commit details
    Browse the repository at this point in the history

  78. Populate host.name / host.hostname

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    c142c74 View commit details
    Browse the repository at this point in the history

  79. Update dashboard

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    e9d8528 View commit details
    Browse the repository at this point in the history

  80. New dashboard image

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    238da18 View commit details
    Browse the repository at this point in the history

  81. User IAM events

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    757d59a View commit details
    Browse the repository at this point in the history

  82. Update dashboard again

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    be6cb78 View commit details
    Browse the repository at this point in the history

  83. Fix double backslashes

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    03002d2 View commit details
    Browse the repository at this point in the history

  84. Use triple braces for mustache in processors

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    43a1cb8 View commit details
    Browse the repository at this point in the history

  85. Remove duplicate observer fields

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    0fd761b View commit details
    Browse the repository at this point in the history

  86. No need to populate host.hostname

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    d565794 View commit details
    Browse the repository at this point in the history

  87. Remove duplicated message_id

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    b71a273 View commit details
    Browse the repository at this point in the history

  88. More triple braces for mustache

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    552d9e4 View commit details
    Browse the repository at this point in the history

  89. Mage update

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    6f3a77d View commit details
    Browse the repository at this point in the history

  90. Comment improvements

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    d846f02 View commit details
    Browse the repository at this point in the history

  91. Disable debug in XSL file

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    68ecae8 View commit details
    Browse the repository at this point in the history

  92. Update XSL link.

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    d7b0bd2 View commit details
    Browse the repository at this point in the history

  93. Add changelog entry

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    11dc572 View commit details
    Browse the repository at this point in the history

  94. Remove redundant test logs

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    86dceae View commit details
    Browse the repository at this point in the history

  95. Add network_direction

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    57123d2 View commit details
    Browse the repository at this point in the history

  96. Use correct log.syslog.priority

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    1685391 View commit details
    Browse the repository at this point in the history

  97. Re-generate golden files with newer 7.13 ES

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    adfc531 View commit details
    Browse the repository at this point in the history

  98. Determine if a field is a valid IP address the 7.13 way

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    4a958f2 View commit details
    Browse the repository at this point in the history

  99. Add station/gateway_station to related.ip

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    0a02a6b View commit details
    Browse the repository at this point in the history

  100. Remove bogus XSL distribution claim from docs

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    1e807b3 View commit details
    Browse the repository at this point in the history

  101. Add description to script processors

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    0fabc9f View commit details
    Browse the repository at this point in the history

  102. Make rfc5424 field a boolean

    @adriansr
    adriansr committed Apr 19, 2021
    Configuration menu
    Copy the full SHA
    d739863 View commit details
    Browse the repository at this point in the history