Skip to content

Commit 78a5f99

Browse files
mjabascal10mjabascal10
committed
feat(crowdstrike): update CrowdStrike integration filter and normalize log fields
1 parent 7afc81b commit 78a5f99

File tree

1 file changed

+311
-14
lines changed

1 file changed

+311
-14
lines changed

‎backend/src/main/resources/config/liquibase/changelog/20260105001_adding_crowdstrike_integration.xml‎

Lines changed: 311 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -172,20 +172,317 @@
172172
VALUES (51, 'crowdstrike', 'CrowdStrike', 'Used to filter logs and apply alerting rules related to CrowdStrike integration', NOW(), true, true);
173173
174174
INSERT INTO utm_logstash_filter (id, logstash_filter, filter_name, filter_group_id, system_owner, module_name, is_active, filter_version, data_type_id)
175-
VALUES (1532, $$
176-
177-
# Crowdstrike module filter, version 1.0.0
178-
# Based in docs and samples provided
179-
#
180-
# Documentations
181-
# 1- https://docs.cyderes.cloud/parser-knowledge-base/cs_stream
182-
183-
pipeline:
184-
- dataTypes:
185-
- crowdstrike
186-
steps:
187-
- json:
188-
source: raw
175+
VALUES (1532, $$ # Crowdstrike module filter, version 1.1.0
176+
# Based in docs and samples provided
177+
#
178+
# Documentations
179+
# 1- https://docs.cyderes.cloud/parser-knowledge-base/cs_stream
180+
181+
pipeline:
182+
- dataTypes:
183+
- crowdstrike
184+
steps:
185+
- json:
186+
source: raw
187+
188+
# .......................................................................#
189+
# Rename to utmstack format to normalize fields
190+
# .......................................................................#
191+
- rename:
192+
from:
193+
- log.RawMessage.event.Attributes.APIClientID
194+
to: log.eventAttributesAPIClientID
195+
196+
- rename:
197+
from:
198+
- log.RawMessage.event.Attributes.actor_cid
199+
to: log.eventAttributesActorCid
200+
201+
- rename:
202+
from:
203+
- log.RawMessage.event.Attributes.actor_user
204+
to: log.eventAttributesActorUser
205+
206+
- rename:
207+
from:
208+
- log.RawMessage.event.Attributes.actor_user_uuid
209+
to: log.eventAttributesActorUserUUID
210+
211+
- rename:
212+
from:
213+
- log.RawMessage.event.Attributes.name
214+
to: log.eventAttributesName
215+
216+
- rename:
217+
from:
218+
- log.RawMessage.event.Attributes.trace_id
219+
to: log.eventAttributesTraceID
220+
221+
- rename:
222+
from:
223+
- log.RawMessage.event.Attributes.cid
224+
to: log.eventAttributesCid
225+
226+
- rename:
227+
from:
228+
- log.RawMessage.event.Attributes.consumes
229+
to: log.eventAttributesConsumes
230+
231+
- rename:
232+
from:
233+
- log.RawMessage.event.Attributes.elapsed_microseconds
234+
to: log.eventAttributesElapsedMicroseconds
235+
236+
- rename:
237+
from:
238+
- log.RawMessage.event.Attributes.elapsed_time
239+
to: log.eventAttributesElapsedTime
240+
241+
- rename:
242+
from:
243+
- log.RawMessage.event.Attributes.produces
244+
to: log.eventAttributesProduces
245+
246+
- rename:
247+
from:
248+
- log.RawMessage.event.Attributes.received_time
249+
to: log.eventAttributesReceivedTime
250+
251+
- rename:
252+
from:
253+
- log.RawMessage.event.Attributes.request_content_type
254+
to: log.eventAttributesRequestContentType
255+
256+
- rename:
257+
from:
258+
- log.RawMessage.event.Attributes.request_method
259+
to: log.eventAttributesRequestMethod
260+
261+
- rename:
262+
from:
263+
- log.RawMessage.event.Attributes.request_uri_length
264+
to: log.eventAttributesRequestURILength
265+
266+
- rename:
267+
from:
268+
- log.RawMessage.event.Attributes.status_code
269+
to: log.statusCode
270+
271+
- rename:
272+
from:
273+
- log.RawMessage.event.Attributes.sub_component_1
274+
to: log.eventAttributesSubComponent1
275+
276+
- rename:
277+
from:
278+
- log.RawMessage.event.Attributes.sub_component_2
279+
to: log.eventAttributesSubComponent2
280+
281+
- rename:
282+
from:
283+
- log.RawMessage.event.Attributes.sub_component_3
284+
to: log.eventAttributesSubComponent3
285+
286+
- rename:
287+
from:
288+
- log.RawMessage.event.Attributes.trace_id
289+
to: log.eventAttributesTraceID
290+
291+
- rename:
292+
from:
293+
- log.RawMessage.event.Attributes.user_agent
294+
to: log.eventAttributesUserAgent
295+
296+
- rename:
297+
from:
298+
- log.RawMessage.event.Attributes.eventType
299+
to: log.eventAttributesEventType
300+
301+
- rename:
302+
from:
303+
- log.RawMessage.event.Attributes.offset
304+
to: log.eventAttributesOffset
305+
306+
- rename:
307+
from:
308+
- log.RawMessage.event.Attributes.partition
309+
to: log.eventAttributesPartition
310+
311+
- rename:
312+
from:
313+
- log.RawMessage.event.Attributes.request_accept
314+
to: log.eventAttributesRequestAccept
315+
316+
- rename:
317+
from:
318+
- log.RawMessage.event.Attributes.request_path
319+
to: log.eventAttributesRequestPath
320+
321+
- rename:
322+
from:
323+
- log.RawMessage.event.Attributes.request_query
324+
to: log.eventAttributesRequestQuery
325+
326+
- rename:
327+
from:
328+
- log.RawMessage.event.Attributes.scopes
329+
to: log.eventAttributesScopes
330+
331+
- rename:
332+
from:
333+
- log.RawMessage.event.AuditKeyValues
334+
to: log.eventAuditKeyValues
335+
336+
- rename:
337+
from:
338+
- log.RawMessage.event.Message
339+
to: log.eventMessage
340+
341+
- rename:
342+
from:
343+
- log.RawMessage.event.OperationName
344+
to: log.eventOperationName
345+
346+
- rename:
347+
from:
348+
- log.RawMessage.event.ServiceName
349+
to: log.eventServiceName
350+
351+
- rename:
352+
from:
353+
- log.RawMessage.event.Source
354+
to: log.eventSource
355+
356+
- rename:
357+
from:
358+
- log.RawMessage.event.ServiceName
359+
to: log.eventServiceName
360+
361+
- rename:
362+
from:
363+
- log.RawMessage.event.SourceIp
364+
to: origin.ip
365+
366+
- rename:
367+
from:
368+
- log.RawMessage.event.Success
369+
to: log.eventSuccess
370+
371+
- rename:
372+
from:
373+
- log.RawMessage.event.UTCTimestamp
374+
to: log.eventUTCTimestamp
375+
376+
- rename:
377+
from:
378+
- log.RawMessage.event.UserId
379+
to: log.eventUserId
380+
381+
- rename:
382+
from:
383+
- log.RawMessage.metadata.customerIDString
384+
to: log.metadataCustomerIDString
385+
386+
- rename:
387+
from:
388+
- log.RawMessage.metadata.eventCreationTime
389+
to: log.metadataEventCreationTime
390+
391+
- rename:
392+
from:
393+
- log.RawMessage.metadata.eventType
394+
to: log.metadataEventType
395+
396+
- rename:
397+
from:
398+
- log.RawMessage.metadata.offset
399+
to: log.metadataOffset
400+
401+
- rename:
402+
from:
403+
- log.RawMessage.metadata.version
404+
to: log.metadataVersion
405+
406+
# .......................................................................#
407+
# Reformat and field conversions
408+
# .......................................................................#
409+
- cast:
410+
fields:
411+
- log.statusCode
412+
to: float
413+
414+
# .......................................................................#
415+
# Renaming "log.statusCode" to "statusCode" to add it to the event structure
416+
# .......................................................................#
417+
- rename:
418+
from:
419+
- log.statusCode
420+
to: statusCode
421+
422+
# .......................................................................#
423+
# Adding geolocation to origin ip
424+
# .......................................................................#
425+
- dynamic:
426+
plugin: com.utmstack.geolocation
427+
params:
428+
source: origin.ip
429+
destination: origin.geolocation
430+
where: exists("origin.ip")
431+
432+
# .......................................................................#
433+
# Normalizing request method and renaming to action
434+
# .......................................................................#
435+
- add:
436+
function: ''string''
437+
params:
438+
key: action
439+
value: ''get''
440+
where: safe("log.eventAttributesRequestMethod", "") == "GET"
441+
442+
- add:
443+
function: ''string''
444+
params:
445+
key: action
446+
value: ''post''
447+
where: safe("log.eventAttributesRequestMethod", "") == "POST"
448+
449+
- add:
450+
function: ''string''
451+
params:
452+
key: action
453+
value: ''put''
454+
where: safe("log.eventAttributesRequestMethod", "") == "PUT"
455+
456+
- add:
457+
function: ''string''
458+
params:
459+
key: action
460+
value: ''delete''
461+
where: safe("log.eventAttributesRequestMethod", "") == "DELETE"
462+
463+
- add:
464+
function: ''string''
465+
params:
466+
key: action
467+
value: ''request''
468+
where: safe("log.eventAttributesRequestMethod", "") == "REQUEST"
469+
470+
# .......................................................................#
471+
# Removing unused fields
472+
# .......................................................................#
473+
- delete:
474+
fields:
475+
- log.statusCode
476+
- log.RawMessage.event.Attributes
477+
- log.RawMessage.event.UserIp
478+
- log.metadata
479+
- log.event.AuditKeyValues
480+
- log.event.OperationName
481+
- log.event.ServiceName
482+
- log.event.Success
483+
- log.event.UTCTimestamp
484+
- log.event.UserId
485+
- log.event.UserIp
189486
190487
$$, 'CrowdStrike', null, true, 'CROWDSTRIKE', false, '2.0.0', 51);
191488
]]>

0 commit comments

Comments
 (0)