-
Notifications
You must be signed in to change notification settings - Fork 422
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[panw_metrics] Add Palo Alto Networks metrics integration #11099
Draft
gpop63
wants to merge
17
commits into
elastic:main
Choose a base branch
from
gpop63:add_panw_metrics_integration
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Draft
Changes from all commits
Commits
Show all changes
17 commits
Select commit
Hold shift + click to select a range
89095d7
bootstrap integration
gpop63 7832f2a
add interfaces data stream
gpop63 b66c315
add routing data stream
gpop63 b8de511
add system data stream
gpop63 cd64f0e
add vpn data stream
gpop63 5c16335
remove commented line
gpop63 fdb4d9e
remove dataset from sample_event files
gpop63 2db8fe5
group fields in interfaces data stream
gpop63 a46c917
group fields in routing data stream
gpop63 e476d33
group fields in system data stream
gpop63 f97f440
group fields in vpn data stream
gpop63 5864b12
lint and build docs
gpop63 84531cb
fix title and description in vpn manifest
gpop63 4469e54
move ipsec_tunnel metrics to routing
gpop63 755e5b8
add placeholder for configuration in docs
gpop63 aaab4ad
update interfaces dataset docs
gpop63 abdce3a
move ipsec_tunnel metrics to routing in sample events
gpop63 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
dependencies: | ||
ecs: | ||
reference: "[email protected]" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,67 @@ | ||
# Palo Alto Networks Integration | ||
|
||
This integration periodically fetches metrics from [Palo Alto Networks](https://www.paloaltonetworks.com/) firewalls and management systems. | ||
|
||
## Compatibility | ||
|
||
The integration uses the [Pango](https://github.com/PaloAltoNetworks/pango) library to collect metrics from Palo Alto Networks firewalls. | ||
|
||
## Configuration | ||
|
||
## Metrics | ||
|
||
### interfaces | ||
|
||
The `interfaces` dataset collects detailed network interface statistics from Palo Alto Networks firewalls. It provides information about interface status, traffic throughput, packet counts, error rates, and configuration details, including physical, logical, and high-availability (HA) interfaces. | ||
|
||
{{event "interfaces"}} | ||
|
||
The fields reported are: | ||
|
||
**ECS Field Reference** | ||
|
||
Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. | ||
|
||
{{fields "interfaces"}} | ||
|
||
### routing | ||
|
||
The `routing` dataset gathers comprehensive routing information from Palo Alto Networks devices. It includes details about routing protocols (with a focus on BGP), static and dynamic routes, next hops, AS numbers, and peer states. This dataset provides insights into the device's routing table and its interactions with other network devices. | ||
|
||
{{event "routing"}} | ||
|
||
The fields reported are: | ||
|
||
**ECS Field Reference** | ||
|
||
Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. | ||
|
||
{{fields "routing"}} | ||
|
||
### system | ||
|
||
The `system` dataset collects a wide range of system-level metrics from Palo Alto Networks firewalls. This includes CPU usage, memory utilization, disk space, load averages, and process statistics. It also provides information about system uptime, licensed features, file system usage, and hardware component status (such as fans, thermal sensors, and power supplies). | ||
|
||
{{event "system"}} | ||
|
||
The fields reported are: | ||
|
||
**ECS Field Reference** | ||
|
||
Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. | ||
|
||
{{fields "system"}} | ||
|
||
### vpn | ||
|
||
The `vpn` dataset gathers detailed Virtual Private Network (VPN) statistics from Palo Alto Networks devices. It covers both GlobalProtect and IPsec VPN technologies, providing information about active VPN sessions, user connections, tunnel status, encryption details, and performance metrics. This dataset offers insights into VPN usage, security, and performance. | ||
|
||
{{event "vpn"}} | ||
|
||
The fields reported are: | ||
|
||
**ECS Field Reference** | ||
|
||
Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. | ||
|
||
{{fields "vpn"}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
# newer versions go on top | ||
- version: "0.0.1" | ||
changes: | ||
- description: Initial draft of the package | ||
type: enhancement | ||
link: https://github.com/elastic/integrations/pull/11099 |
6 changes: 6 additions & 0 deletions
6
packages/panw_metrics/data_stream/interfaces/agent/stream/stream.yml.hbs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
metricsets: ["interfaces"] | ||
period: {{period}} | ||
host_ip: {{host_ip}} | ||
port: {{port}} | ||
apiKey: {{apiKey}} | ||
apiDebugMode: {{apiDebugMode}} |
33 changes: 33 additions & 0 deletions
33
packages/panw_metrics/data_stream/interfaces/fields/agent.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,33 @@ | ||
- name: cloud | ||
title: Cloud | ||
group: 2 | ||
description: Fields related to the cloud or infrastructure the events are coming from. | ||
footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' | ||
type: group | ||
fields: | ||
- name: image.id | ||
type: keyword | ||
description: Image ID for the cloud instance. | ||
- name: host | ||
title: Host | ||
group: 2 | ||
description: 'A host is defined as a general computing instance. ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' | ||
type: group | ||
fields: | ||
- name: containerized | ||
type: boolean | ||
description: > | ||
If the host is a container. | ||
|
||
- name: os.build | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Are these not ecs fields ? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. You suggest removing the entire |
||
type: keyword | ||
example: "18D109" | ||
description: > | ||
OS build information. | ||
|
||
- name: os.codename | ||
type: keyword | ||
example: "stretch" | ||
description: > | ||
OS codename, if any. | ||
|
12 changes: 12 additions & 0 deletions
12
packages/panw_metrics/data_stream/interfaces/fields/base-fields.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
- name: data_stream.type | ||
type: constant_keyword | ||
description: Data stream type. | ||
- name: data_stream.dataset | ||
type: constant_keyword | ||
description: Data stream dataset. | ||
- name: data_stream.namespace | ||
type: constant_keyword | ||
description: Data stream namespace. | ||
- name: '@timestamp' | ||
type: date | ||
description: Event timestamp. |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@tommyers-elastic , should we consider mentioned, which version of PanOS, the integration is tested with, additionally?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we also add a section for configuration, highlighting the details of connectivity parameters / connection string, how to get the API key, any specific permissions to be added?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we have any documentation on permissions required, connection string etc? Not sure where to get this info.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we do not have the information right now for this, let us leave a placeholder for
Configuration
(heading) , the content below it can be filled later.