[checkpoint]: fix handling of different user formats (#20183)

- Add grok processors to better handle different formattings of the user
fields in checkpoint logs. Added support for full name with email, email,
and name only.

Author: taylor-swanson

packages/checkpoint/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.48.0"
+  changes:
+    - description: Improve handling of different user formats in logs.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20183
 - version: "1.47.0"
   changes:
     - description: Populate observer.ip with the Check Point gateway IP from the origin field, and add observer.hostname from the CN of originsicname, in the firewall data stream.

packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log

@@ -255,23 +255,30 @@ processors:
       field: checkpoint.uid
       target_field: source.user.id
       ignore_missing: true
-  - set:
-      tag: set_source_user_name_276eacf0
-      field: source.user.name
-      copy_from: checkpoint.src_user_name
-      ignore_empty_value: true
-  - set:
-      tag: set_source_user_name_d2cd1e3b
-      field: source.user.name
-      copy_from: checkpoint.administrator
-      if: ctx.source?.user?.name == null
-      ignore_empty_value: true
-  - set:
-      tag: set_user_name_9961f466
-      field: user.name
-      copy_from: checkpoint.user
-      if: ctx.user?.name == null
-      ignore_empty_value: true
+  - grok:
+      tag: grok_src_user_name
+      field: checkpoint.src_user_name
+      if: ctx.checkpoint?.src_user_name != null
+      patterns:
+        - "^%{DATA:source.user.full_name} \\(%{EMAILADDRESS:source.user.email}\\)$"
+        - "^%{EMAILADDRESS:source.user.email}$"
+        - "^%{DATA:source.user.name}$"
+  - grok:
+      tag: grok_administrator
+      field: checkpoint.administrator
+      if: ctx.checkpoint?.administrator != null && ctx.source?.user?.name == null && ctx.source?.user?.email == null
+      patterns:
+        - "^%{DATA:source.user.full_name} \\(%{EMAILADDRESS:source.user.email}\\)$"
+        - "^%{EMAILADDRESS:source.user.email}$"
+        - "^%{DATA:source.user.name}$"
+  - grok:
+      tag: grok_user
+      field: checkpoint.user
+      if: ctx.checkpoint?.user != null && ctx.user?.name == null
+      patterns:
+        - "^%{DATA:user.full_name} \\(%{EMAILADDRESS:user.email}\\)$"
+        - "^%{EMAILADDRESS:user.email}$"
+        - "^%{DATA:user.name}$"
   - convert:
       tag: convert_checkpoint_failed_login_factor_num_919842ca
       field: checkpoint.failed_login_factor_num
@@ -374,11 +381,14 @@ processors:
       target_field: destination.domain
       if: ctx.server?.domain == null
       ignore_missing: true
-  - set:
-      tag: set_destination_user_name_ccf3ca27
-      field: destination.user.name
-      copy_from: checkpoint.dst_user_name
+  - grok:
+      tag: grok_dst_user_name
+      field: checkpoint.dst_user_name
       if: ctx.checkpoint?.dst_user_name != null
+      patterns:
+        - "^%{DATA:destination.user.full_name} \\(%{EMAILADDRESS:destination.user.email}\\)$"
+        - "^%{EMAILADDRESS:destination.user.email}$"
+        - "^%{DATA:destination.user.name}$"
   - set:
       tag: set_destination_user_domain_d38bee06
       field: destination.user.domain
@@ -794,6 +804,12 @@ processors:
       value: '{{{ source.user.name }}}'
       override: false
       ignore_empty_value: true
+  - set:
+      tag: set_user_full_name_4f1523ba
+      field: user.full_name
+      value: '{{{ source.user.full_name }}}'
+      override: false
+      ignore_empty_value: true
   - set:
       tag: set_user_id_cc07e8aa
       field: user.id
@@ -1498,11 +1514,6 @@ processors:
       replacement: ""
       if: ctx.checkpoint?.sys_message != null
   # Standardize user fields
-  - rename:
-      target_field: user.email
-      field: user.name
-      tag: rename_user_email
-      if: ctx.user?.email == null && ctx.user?.name != null && ctx.user.name.indexOf("@") > 0
   - dissect:
       field: user.email
       pattern: '%{user.name}@%{user.domain}'
@@ -1522,17 +1533,18 @@ processors:
       value: "{{{user.name}}}"
       allow_duplicates: false
       if: ctx.user?.name != null
+  - append:
+      tag: append_related_user_7021abb5
+      field: related.user
+      value: "{{{user.full_name}}}"
+      allow_duplicates: false
+      if: ctx.user?.full_name != null
   - append:
       tag: append_related_user_34fcf415
       field: related.user
       value: "{{{user.email}}}"
       allow_duplicates: false
       if: ctx.user?.email != null
-  - rename:
-      target_field: source.user.email
-      field: source.user.name
-      tag: rename_source_user_email
-      if: ctx.source?.user?.email == null && ctx.source?.user?.name != null && ctx.source.user.name.indexOf("@") > 0
   - dissect:
       field: source.user.email
       pattern: '%{source.user.name}@%{source.user.domain}'
@@ -1558,11 +1570,12 @@ processors:
       value: "{{{source.user.email}}}"
       allow_duplicates: false
       if: ctx.source?.user?.email != null
-  - rename:
-      target_field: destination.user.email
-      field: destination.user.name
-      tag: rename_destination_user_email
-      if: ctx.destination?.user?.email == null && ctx.destination?.user?.name != null && ctx.destination.user.name.indexOf("@") > 0
+  - append:
+      tag: append_related_user_18471188
+      field: related.user
+      value: "{{{source.user.full_name}}}"
+      allow_duplicates: false
+      if: ctx.source?.user?.full_name != null
   - dissect:
       field: destination.user.email
       pattern: '%{destination.user.name}@%{destination.user.domain}'
@@ -1588,6 +1601,12 @@ processors:
       value: "{{{destination.user.email}}}"
       allow_duplicates: false
       if: ctx.destination?.user?.email != null
+  - append:
+      tag: append_related_user_7ec630c0
+      field: related.user
+      value: "{{{destination.user.full_name}}}"
+      allow_duplicates: false
+      if: ctx.destination?.user?.full_name != null
 
   - script:
       tag: script_422800ed

packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json

@@ -40,6 +40,8 @@
   name: destination.user.email
 - external: ecs
   name: destination.user.id
+- external: ecs
+  name: destination.user.full_name
 - external: ecs
   name: destination.user.name
 - external: ecs
@@ -236,6 +238,8 @@
   name: source.user.group.name
 - external: ecs
   name: source.user.id
+- external: ecs
+  name: source.user.full_name
 - external: ecs
   name: source.user.name
 - external: ecs
@@ -252,6 +256,8 @@
   name: vulnerability.id
 - external: ecs
   name: log.file.path
+- external: ecs
+  name: user.full_name
 - external: ecs
   name: user.name
 - external: ecs

packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml

@@ -732,6 +732,8 @@ The raw `originsicname` value is preserved in `checkpoint.origin_sic_name`. Beca
 | destination.service.name | Name of the service data is collected from. | keyword |
 | destination.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword |
 | destination.user.email | User email address. | keyword |
+| destination.user.full_name | User's full name, if available. | keyword |
+| destination.user.full_name.text | Multi-field of `destination.user.full_name`. | match_only_text |
 | destination.user.id | Unique identifier of the user. | keyword |
 | destination.user.name | Short name or login of the user. | keyword |
 | destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text |
@@ -857,6 +859,8 @@ The raw `originsicname` value is preserved in `checkpoint.origin_sic_name`. Beca
 | source.port | Port of the source. | long |
 | source.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword |
 | source.user.email | User email address. | keyword |
+| source.user.full_name | User's full name, if available. | keyword |
+| source.user.full_name.text | Multi-field of `source.user.full_name`. | match_only_text |
 | source.user.group.name | Name of the group. | keyword |
 | source.user.id | Unique identifier of the user. | keyword |
 | source.user.name | Short name or login of the user. | keyword |
@@ -867,6 +871,8 @@ The raw `originsicname` value is preserved in `checkpoint.origin_sic_name`. Beca
 | url.original.text | Multi-field of `url.original`. | match_only_text |
 | user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword |
 | user.email | User email address. | keyword |
+| user.full_name | User's full name, if available. | keyword |
+| user.full_name.text | Multi-field of `user.full_name`. | match_only_text |
 | user.group.name | Name of the group. | keyword |
 | user.id | Unique identifier of the user. | keyword |
 | user.name | Short name or login of the user. | keyword |

packages/checkpoint/data_stream/firewall/fields/ecs.yml

@@ -1,6 +1,6 @@
 name: checkpoint
 title: Check Point
-version: "1.47.0"
+version: "1.48.0"
 description: Collect logs from Check Point with Elastic Agent.
 type: integration
 format_version: "3.0.3"