Skip to content

Commit c7ef352

Browse files
jbfeldman-ddclaude
jbfeldman-dd
and
claude
authored
[azure_active_directory] Add grok parsers to extract port from IP:port (DataDog#23870)
* [azure_active_directory] Add grok parsers to extract port from IP:port in ocsf.src_endpoint.ip and network.client.ip Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * [azure_active_directory] Add grok parsers to extract port from IP:port in ocsf.src_endpoint.ip and network.client.ip Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * add facet * Fix test expectations: port values are strings from grok parser Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add integer cast remappers for port fields after grok parsers Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Move ocsf.src_endpoint.port integer cast to post transformations pipeline Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 8530079 commit c7ef352

2 files changed

Lines changed: 100 additions & 6 deletions

File tree

‎azure_active_directory/assets/logs/azure.activedirectory.yaml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,11 @@ facets:
8383
name: Client IP
8484
path: network.client.ip
8585
source: log
86+
- groups:
87+
- Web Access
88+
name: Client Port
89+
path: network.client.port
90+
source: log
8691
- groups:
8792
- User
8893
name: User Email
@@ -200,6 +205,13 @@ facets:
200205
name: Source IP Address
201206
path: ocsf.src_endpoint.ip
202207
source: log
208+
- facetType: range
209+
groups:
210+
- OCSF
211+
name: Src Endpoint Port
212+
path: ocsf.src_endpoint.port
213+
source: log
214+
type: integer
203215
- groups:
204216
- OCSF
205217
name: Event Code
@@ -281,6 +293,29 @@ pipeline:
281293
overrideOnConflict: false
282294
sourceType: attribute
283295
targetType: attribute
296+
- type: grok-parser
297+
name: Parse `network.client.ip` to `network.client.ip`, `network.client.port`
298+
enabled: true
299+
source: network.client.ip
300+
grok:
301+
supportRules: |
302+
matchRules: |
303+
ipv4_rule %{ipv4:network.client.ip}(:%{port:network.client.port})?
304+
ipv6_rule \[?%{ipv6:network.client.ip}\]?(:%{port:network.client.port})?
305+
samples:
306+
- 15.113.255.209
307+
- 15.113.255.209:21341
308+
- type: attribute-remapper
309+
name: Map `network.client.port` to `network.client.port`
310+
enabled: true
311+
sources:
312+
- network.client.port
313+
sourceType: attribute
314+
target: network.client.port
315+
targetType: attribute
316+
targetFormat: integer
317+
preserveSource: false
318+
overrideOnConflict: false
284319
- type: arithmetic-processor
285320
name: Compute duration in nanoseconds from durationMs in miliseconds
286321
enabled: true
@@ -548,6 +583,18 @@ pipeline:
548583
targetType: attribute
549584
preserveSource: true
550585
overrideOnConflict: false
586+
- type: grok-parser
587+
name: Parse `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.ip`, `ocsf.src_endpoint.port`
588+
enabled: true
589+
source: ocsf.src_endpoint.ip
590+
grok:
591+
supportRules: |
592+
matchRules: |
593+
ipv4_rule %{ipv4:ocsf.src_endpoint.ip}(:%{port:ocsf.src_endpoint.port})?
594+
ipv6_rule \[?%{ipv6:ocsf.src_endpoint.ip}\]?(:%{port:ocsf.src_endpoint.port})?
595+
samples:
596+
- 15.113.255.209
597+
- 15.113.255.209:21341
551598
- type: attribute-remapper
552599
name: Map `properties.resultReason` to `ocsf.status_code`
553600
enabled: true
@@ -1019,6 +1066,18 @@ pipeline:
10191066
targetType: attribute
10201067
preserveSource: true
10211068
overrideOnConflict: false
1069+
- type: grok-parser
1070+
name: Parse `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.ip`, `ocsf.src_endpoint.port`
1071+
enabled: true
1072+
source: ocsf.src_endpoint.ip
1073+
grok:
1074+
supportRules: |
1075+
matchRules: |
1076+
ipv4_rule %{ipv4:ocsf.src_endpoint.ip}(:%{port:ocsf.src_endpoint.port})?
1077+
ipv6_rule \[?%{ipv6:ocsf.src_endpoint.ip}\]?(:%{port:ocsf.src_endpoint.port})?
1078+
samples:
1079+
- 15.113.255.209
1080+
- 15.113.255.209:21341
10221081
- type: attribute-remapper
10231082
name: Map `properties.deviceDetail.operatingSystem` to `ocsf.src_endpoint.os.name`
10241083
enabled: true
@@ -1877,6 +1936,18 @@ pipeline:
18771936
targetType: attribute
18781937
preserveSource: true
18791938
overrideOnConflict: false
1939+
- type: grok-parser
1940+
name: Parse `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.ip`, `ocsf.src_endpoint.port`
1941+
enabled: true
1942+
source: ocsf.src_endpoint.ip
1943+
grok:
1944+
supportRules: |
1945+
matchRules: |
1946+
ipv4_rule %{ipv4:ocsf.src_endpoint.ip}(:%{port:ocsf.src_endpoint.port})?
1947+
ipv6_rule \[?%{ipv6:ocsf.src_endpoint.ip}\]?(:%{port:ocsf.src_endpoint.port})?
1948+
samples:
1949+
- 15.113.255.209
1950+
- 15.113.255.209:21341
18801951
- type: string-builder-processor
18811952
name: Add dst_endpoint.hostname
18821953
enabled: true
@@ -2194,6 +2265,16 @@ pipeline:
21942265
targetType: attribute
21952266
preserveSource: false
21962267
overrideOnConflict: false
2268+
- type: attribute-remapper
2269+
name: Map `ocsf.src_endpoint.port` to `network.client.port`
2270+
enabled: true
2271+
sources:
2272+
- ocsf.src_endpoint.port
2273+
sourceType: attribute
2274+
target: callerIpAddress
2275+
targetType: attribute
2276+
preserveSource: false
2277+
overrideOnConflict: false
21972278
- type: pipeline
21982279
name: OCSF post transformations
21992280
enabled: true
@@ -2296,3 +2377,14 @@ pipeline:
22962377
targetFormat: integer
22972378
preserveSource: false
22982379
overrideOnConflict: false
2380+
- type: attribute-remapper
2381+
name: Map `ocsf.src_endpoint.port` to `ocsf.src_endpoint.port`
2382+
enabled: true
2383+
sources:
2384+
- ocsf.src_endpoint.port
2385+
sourceType: attribute
2386+
target: ocsf.src_endpoint.port
2387+
targetType: attribute
2388+
targetFormat: integer
2389+
preserveSource: false
2390+
overrideOnConflict: false

‎azure_active_directory/assets/logs/azure.activedirectory_tests.yaml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,7 @@ tests:
328328
"tenantId": "4d3bac44-0230-4732-9e70-cc00736f0a97",
329329
"resultSignature": "None",
330330
"durationMs": 0,
331-
"callerIpAddress": "192.182.149.21",
331+
"callerIpAddress": "192.182.149.21:43210",
332332
"correlationId": "a13bd0fa-70d0-4e60-ae23-b687377b4695",
333333
"Level": 4,
334334
"properties": {
@@ -353,7 +353,7 @@ tests:
353353
"id": "018af091-5465-4aed-9d6f-8c40981b2375",
354354
"displayName": null,
355355
"userPrincipalName": "test.test@datadoghq.com",
356-
"ipAddress": "192.182.149.21",
356+
"ipAddress": "192.182.149.21:43210",
357357
"roles": []
358358
}
359359
},
@@ -384,7 +384,7 @@ tests:
384384
result:
385385
custom:
386386
Level: 4
387-
callerIpAddress: "192.182.149.21"
387+
callerIpAddress: "192.182.149.21:43210"
388388
category: "AuditLogs"
389389
correlationId: "a13bd0fa-70d0-4e60-ae23-b687377b4695"
390390
duration: 0.0
@@ -397,6 +397,7 @@ tests:
397397
client:
398398
geoip: {}
399399
ip: "192.182.149.21"
400+
port: 43210
400401
ocsf:
401402
activity_id: 6
402403
activity_name: "Delete"
@@ -427,6 +428,7 @@ tests:
427428
severity_id: 1
428429
src_endpoint:
429430
ip: "192.182.149.21"
431+
port: 43210
430432
status: "Success"
431433
status_code: ""
432434
status_id: 1
@@ -453,7 +455,7 @@ tests:
453455
initiatedBy:
454456
user:
455457
id: "018af091-5465-4aed-9d6f-8c40981b2375"
456-
ipAddress: "192.182.149.21"
458+
ipAddress: "192.182.149.21:43210"
457459
userPrincipalName: "test.test@datadoghq.com"
458460
loggedByService: "Core Directory"
459461
operationName: "Delete user"
@@ -481,7 +483,7 @@ tests:
481483
name: "test.test@datadoghq.com"
482484
message: |-
483485
{
484-
"callerIpAddress" : "192.182.149.21",
486+
"callerIpAddress" : "192.182.149.21:43210",
485487
"resourceId" : "/tenants/4d3bac44-0230-4732-9e70-cc00736f0a97/providers/Microsoft.aadiam",
486488
"operationVersion" : "1.0",
487489
"tenantId" : "4d3bac44-0230-4732-9e70-cc00736f0a97",
@@ -522,7 +524,7 @@ tests:
522524
"resultType" : "",
523525
"initiatedBy" : {
524526
"user" : {
525-
"ipAddress" : "192.182.149.21",
527+
"ipAddress" : "192.182.149.21:43210",
526528
"id" : "018af091-5465-4aed-9d6f-8c40981b2375",
527529
"userPrincipalName" : "test.test@datadoghq.com"
528530
}

0 commit comments

Comments
 (0)