Skip to content

Commit 2b6bb5b

Browse files
osmonteroosmontero
committed
Merge remote-tracking branch 'origin/release/v11.2.3' into release/v11.2.3
# Conflicts: # backend/src/main/resources/config/liquibase/master.xml
2 parents 76563e3 + c82b4de commit 2b6bb5b

File tree

13 files changed

+389
-20
lines changed

13 files changed

+389
-20
lines changed

‎backend/src/main/java/com/park/utmstack/config/OpenApiConfiguration.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ public OpenAPI customOpenAPI() {
3434
.addList(securitySchemeApiInternalKey)
3535
.addList(securitySchemeApiKey))
3636
.components(new Components()
37-
.addSecuritySchemes(securitySchemeBearer,
37+
/*.addSecuritySchemes(securitySchemeBearer,
3838
new SecurityScheme()
3939
.name(securitySchemeBearer)
4040
.type(SecurityScheme.Type.HTTP)
@@ -43,7 +43,7 @@ public OpenAPI customOpenAPI() {
4343
.addSecuritySchemes(securitySchemeApiInternalKey, new SecurityScheme()
4444
.name("Utm-Internal-Key")
4545
.type(SecurityScheme.Type.APIKEY)
46-
.in(SecurityScheme.In.HEADER))
46+
.in(SecurityScheme.In.HEADER))*/
4747
.addSecuritySchemes(securitySchemeApiKey, new SecurityScheme()
4848
.name(Constants.API_KEY_HEADER)
4949
.type(SecurityScheme.Type.APIKEY)

‎backend/src/main/resources/config/liquibase/changelog/20260202001_update_linux_auditing_module.xml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20260202001" author="Manuel">
8+
9+
<update tableName="utm_module">
10+
<column name="pretty_name" value="Linux Audit Daemon"/>
11+
<column name="module_description" value="The Linux Auditing Daemon runs as a background service that collects audit events and writes them to disk."/>
12+
<where>module_name = 'AUDITD'</where>
13+
</update>
14+
15+
</changeSet>
16+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/changelog/20260202002_update_filter_crowdstrike.xml‎

Lines changed: 330 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,330 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20260202002" author="Manuel">
8+
9+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
10+
<![CDATA[
11+
12+
UPDATE public.utm_logstash_filter
13+
SET filter_version='1.1.1',
14+
logstash_filter = $$ # Crowdstrike module filter, version 1.1.0
15+
# Based in docs and samples provided
16+
#
17+
# Documentations
18+
# 1- https://docs.cyderes.cloud/parser-knowledge-base/cs_stream
19+
20+
pipeline:
21+
- dataTypes:
22+
- crowdstrike
23+
steps:
24+
- json:
25+
source: raw
26+
27+
# .......................................................................#
28+
# Rename to utmstack format to normalize fields
29+
# .......................................................................#
30+
- rename:
31+
from:
32+
- log.RawMessage.event.Attributes.APIClientID
33+
to: log.eventAttributesAPIClientID
34+
35+
- rename:
36+
from:
37+
- log.RawMessage.event.Attributes.actor_cid
38+
to: log.eventAttributesActorCid
39+
40+
- rename:
41+
from:
42+
- log.RawMessage.event.Attributes.actor_user
43+
to: log.eventAttributesActorUser
44+
45+
- rename:
46+
from:
47+
- log.RawMessage.event.Attributes.actor_user_uuid
48+
to: log.eventAttributesActorUserUUID
49+
50+
- rename:
51+
from:
52+
- log.RawMessage.event.Attributes.name
53+
to: log.eventAttributesName
54+
55+
- rename:
56+
from:
57+
- log.RawMessage.event.Attributes.trace_id
58+
to: log.eventAttributesTraceID
59+
60+
- rename:
61+
from:
62+
- log.RawMessage.event.Attributes.cid
63+
to: log.eventAttributesCid
64+
65+
- rename:
66+
from:
67+
- log.RawMessage.event.Attributes.consumes
68+
to: log.eventAttributesConsumes
69+
70+
- rename:
71+
from:
72+
- log.RawMessage.event.Attributes.elapsed_microseconds
73+
to: log.eventAttributesElapsedMicroseconds
74+
75+
- rename:
76+
from:
77+
- log.RawMessage.event.Attributes.elapsed_time
78+
to: log.eventAttributesElapsedTime
79+
80+
- rename:
81+
from:
82+
- log.RawMessage.event.Attributes.produces
83+
to: log.eventAttributesProduces
84+
85+
- rename:
86+
from:
87+
- log.RawMessage.event.Attributes.received_time
88+
to: log.eventAttributesReceivedTime
89+
90+
- rename:
91+
from:
92+
- log.RawMessage.event.Attributes.request_content_type
93+
to: log.eventAttributesRequestContentType
94+
95+
- rename:
96+
from:
97+
- log.RawMessage.event.Attributes.request_method
98+
to: log.eventAttributesRequestMethod
99+
100+
- rename:
101+
from:
102+
- log.RawMessage.event.Attributes.request_uri_length
103+
to: log.eventAttributesRequestURILength
104+
105+
- rename:
106+
from:
107+
- log.RawMessage.event.Attributes.status_code
108+
to: log.statusCode
109+
110+
- rename:
111+
from:
112+
- log.RawMessage.event.Attributes.sub_component_1
113+
to: log.eventAttributesSubComponent1
114+
115+
- rename:
116+
from:
117+
- log.RawMessage.event.Attributes.sub_component_2
118+
to: log.eventAttributesSubComponent2
119+
120+
- rename:
121+
from:
122+
- log.RawMessage.event.Attributes.sub_component_3
123+
to: log.eventAttributesSubComponent3
124+
125+
- rename:
126+
from:
127+
- log.RawMessage.event.Attributes.trace_id
128+
to: log.eventAttributesTraceID
129+
130+
- rename:
131+
from:
132+
- log.RawMessage.event.Attributes.user_agent
133+
to: log.eventAttributesUserAgent
134+
135+
- rename:
136+
from:
137+
- log.RawMessage.event.Attributes.eventType
138+
to: log.eventAttributesEventType
139+
140+
- rename:
141+
from:
142+
- log.RawMessage.event.Attributes.offset
143+
to: log.eventAttributesOffset
144+
145+
- rename:
146+
from:
147+
- log.RawMessage.event.Attributes.partition
148+
to: log.eventAttributesPartition
149+
150+
- rename:
151+
from:
152+
- log.RawMessage.event.Attributes.request_accept
153+
to: log.eventAttributesRequestAccept
154+
155+
- rename:
156+
from:
157+
- log.RawMessage.event.Attributes.request_path
158+
to: log.eventAttributesRequestPath
159+
160+
- rename:
161+
from:
162+
- log.RawMessage.event.Attributes.request_query
163+
to: log.eventAttributesRequestQuery
164+
165+
- rename:
166+
from:
167+
- log.RawMessage.event.Attributes.scopes
168+
to: log.eventAttributesScopes
169+
170+
- rename:
171+
from:
172+
- log.RawMessage.event.AuditKeyValues
173+
to: log.eventAuditKeyValues
174+
175+
- rename:
176+
from:
177+
- log.RawMessage.event.Message
178+
to: log.eventMessage
179+
180+
- rename:
181+
from:
182+
- log.RawMessage.event.OperationName
183+
to: log.eventOperationName
184+
185+
- rename:
186+
from:
187+
- log.RawMessage.event.ServiceName
188+
to: log.eventServiceName
189+
190+
- rename:
191+
from:
192+
- log.RawMessage.event.Source
193+
to: log.eventSource
194+
195+
- rename:
196+
from:
197+
- log.RawMessage.event.ServiceName
198+
to: log.eventServiceName
199+
200+
- rename:
201+
from:
202+
- log.RawMessage.event.SourceIp
203+
to: origin.ip
204+
205+
- rename:
206+
from:
207+
- log.RawMessage.event.Success
208+
to: log.eventSuccess
209+
210+
- rename:
211+
from:
212+
- log.RawMessage.event.UTCTimestamp
213+
to: log.eventUTCTimestamp
214+
215+
- rename:
216+
from:
217+
- log.RawMessage.event.UserId
218+
to: log.eventUserId
219+
220+
- rename:
221+
from:
222+
- log.RawMessage.metadata.customerIDString
223+
to: log.metadataCustomerIDString
224+
225+
- rename:
226+
from:
227+
- log.RawMessage.metadata.eventCreationTime
228+
to: log.metadataEventCreationTime
229+
230+
- rename:
231+
from:
232+
- log.RawMessage.metadata.eventType
233+
to: log.metadataEventType
234+
235+
- rename:
236+
from:
237+
- log.RawMessage.metadata.offset
238+
to: log.metadataOffset
239+
240+
- rename:
241+
from:
242+
- log.RawMessage.metadata.version
243+
to: log.metadataVersion
244+
245+
# .......................................................................#
246+
# Reformat and field conversions
247+
# .......................................................................#
248+
- cast:
249+
fields:
250+
- log.statusCode
251+
to: float
252+
253+
# .......................................................................#
254+
# Renaming "log.statusCode" to "statusCode" to add it to the event structure
255+
# .......................................................................#
256+
- rename:
257+
from:
258+
- log.statusCode
259+
to: statusCode
260+
261+
# .......................................................................#
262+
# Adding geolocation to origin ip
263+
# .......................................................................#
264+
- dynamic:
265+
plugin: com.utmstack.geolocation
266+
params:
267+
source: origin.ip
268+
destination: origin.geolocation
269+
where: exists("origin.ip")
270+
271+
# .......................................................................#
272+
# Normalizing request method and renaming to action
273+
# .......................................................................#
274+
- add:
275+
function: 'string'
276+
params:
277+
key: action
278+
value: 'get'
279+
where: safe("log.eventAttributesRequestMethod", "") == "GET"
280+
281+
- add:
282+
function: 'string'
283+
params:
284+
key: action
285+
value: 'post'
286+
where: safe("log.eventAttributesRequestMethod", "") == "POST"
287+
288+
- add:
289+
function: 'string'
290+
params:
291+
key: action
292+
value: 'put'
293+
where: safe("log.eventAttributesRequestMethod", "") == "PUT"
294+
295+
- add:
296+
function: 'string'
297+
params:
298+
key: action
299+
value: 'delete'
300+
where: safe("log.eventAttributesRequestMethod", "") == "DELETE"
301+
302+
- add:
303+
function: 'string'
304+
params:
305+
key: action
306+
value: 'request'
307+
where: safe("log.eventAttributesRequestMethod", "") == "REQUEST"
308+
309+
# .......................................................................#
310+
# Removing unused fields
311+
# .......................................................................#
312+
- delete:
313+
fields:
314+
- log.statusCode
315+
- log.RawMessage.event.Attributes
316+
- log.RawMessage.event.UserIp
317+
- log.metadata
318+
- log.event.AuditKeyValues
319+
- log.event.OperationName
320+
- log.event.ServiceName
321+
- log.event.Success
322+
- log.event.UTCTimestamp
323+
- log.event.UserId
324+
- log.event.UserIp
325+
$$
326+
WHERE id=1532;
327+
]]>
328+
</sql>
329+
</changeSet>
330+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/master.xml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,9 @@
327327

328328
<include file="/config/liquibase/changelog/20260129001_update_filter_sophos_xg.xml" relativeToChangelogFile="false"/>
329329

330-
<include file="/config/liquibase/changelog/20260129002_update_filter_pfsense.xml" relativeToChangelogFile="false"/>
330+
<include file="/config/liquibase/changelog/20260202001_update_linux_auditing_module.xml" relativeToChangelogFile="false"/>
331+
332+
<include file="/config/liquibase/changelog/20260202002_update_filter_crowdstrike.xml" relativeToChangelogFile="false"/>
331333

332334

333335

‎frontend/src/app/app-management/utm-api-doc/utm-api-doc.component.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ <h6 class="card-title mb-0 text-uppercase label-header">
66
<div class="align-items-center">
77
<p class="sw-info">
88
Version:
9-
<app-utm-version-info></app-utm-version-info>
9+
<app-utm-version-info [version]="versionInfo"></app-utm-version-info>
1010
</p>
1111
</div>
1212
</div>

0 commit comments

Comments
 (0)