Skip to content

Commit b086bce

Browse files
mjabascal10mjabascal10
committed
Merge remote-tracking branch 'origin/release/v10.8.1' into release/v10.8.1
2 parents 09ef264 + 1ef1e72 commit b086bce

9 files changed

Lines changed: 217 additions & 71 deletions

File tree

‎backend/src/main/java/com/park/utmstack/util/chart_builder/elasticsearch_dsl/responses/impl/coordinate_map/ResponseParserForCoordinateMapChart.java‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,9 @@ public List<CoordinateMapChartResult> parse(UtmVisualization visualization, Sear
4545

4646
if (bucket != null) {
4747
List<BucketAggregation> entries = TermAggregateParser.parse(result.aggregations().get(bucket.getId()));
48-
entries = entries.stream().filter(e -> StringUtils.hasText(e.getKey())).collect(Collectors.toList());
48+
entries = entries.stream().filter(e -> isValidIP(e.getKey()))
49+
.collect(Collectors.toList());
50+
4951

5052
for (BucketAggregation entry : entries) {
5153
GeoIp ipV4Info;
@@ -88,4 +90,25 @@ public List<CoordinateMapChartResult> parse(UtmVisualization visualization, Sear
8890
throw new RuntimeException(ctx + ": " + e.getMessage());
8991
}
9092
}
93+
94+
public static boolean isValidIP(String ip) {
95+
return isValidIPv4(ip) || isValidIPv6(ip);
96+
}
97+
98+
99+
public static boolean isValidIPv4(String ip) {
100+
if (ip == null || ip.isEmpty()) return false;
101+
String regex =
102+
"^((25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)(\\.|$)){4}$";
103+
return ip.matches(regex);
104+
}
105+
106+
public static boolean isValidIPv6(String ip) {
107+
if (ip == null || ip.isEmpty()) return false;
108+
String regex =
109+
"^(?:[\\da-fA-F]{1,4}:){7}[\\da-fA-F]{1,4}$";
110+
return ip.matches(regex);
111+
}
112+
113+
91114
}

‎backend/src/main/resources/config/liquibase/changelog/20250507002_add_sophos_central_pipeline.xml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,21 @@
1212
1313
# Sophos_Central version 1.0.0
1414
15-
split {
16-
field => "message"
17-
terminator => "<utm-log-separator>"
15+
json {
16+
source => "message"
17+
}
18+
19+
if ([dataType] == "sophos-central") {
20+
21+
mutate {
22+
rename => { "[logx][sophos_central][source_info][ip]" => "[logx][sophos_central][source_ip]"}
23+
rename => { "[logx][sophos_central][when]" => "[logx][sophos_central][timestamp_occurred_at]"}
24+
rename => { "[logx][sophos_central][created_at]" => "[logx][sophos_central][timestamp_generated_at]"}
25+
}
26+
27+
mutate {
28+
remove_field => ["headers", "@version", "global", "[logx][sophos_central][core_remedy_items][totalItems]"]
29+
}
1830
}
1931
}', 'sophos-central', null, true, 'SOPHOS', false, '2.0.1');
2032
]]>
@@ -25,7 +37,7 @@
2537

2638

2739
INSERT INTO utm_logstash_pipeline (id, pipeline_id, pipeline_name, parent_pipeline, pipeline_status, module_name, system_owner, pipeline_description, pipeline_internal, events_in, events_filtered, events_out, reloads_successes, reloads_failures, reloads_last_failure_timestamp, reloads_last_error, reloads_last_success_timestamp)
28-
VALUES (56, 'sophos-central', 'Sophos Central', null, 'up', 'AWS', true, null, false, 0, 0, 0, 0, 0, null, null, null);
40+
VALUES (56, 'sophos-central', 'Sophos Central', null, 'up', 'SOPHOS', true, null, false, 0, 0, 0, 0, 0, null, null, null);
2941

3042
INSERT INTO utm_group_logstash_pipeline_filters (filter_id, pipeline_id, relation)
3143
VALUES (1527, 56, 'PIPELINE_FILTER');

‎backend/src/main/resources/config/liquibase/changelog/20250515001_update_filter_aws.xml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20250515001" author="JocLRojas">
8+
9+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
10+
<![CDATA[
11+
12+
UPDATE public.utm_logstash_filter
13+
SET filter_version='2.0.0',
14+
logstash_filter='filter {
15+
16+
# Amazon Web Service version 2.0.0
17+
18+
json {
19+
source => "message"
20+
target => "parsed_message"
21+
}
22+
23+
if ([parsed_message][logx][type] == "aws") {
24+
mutate {
25+
add_field => {
26+
"dataType" => "aws"
27+
"dataSource" => "%{[parsed_message][logx][tenant]}"
28+
}
29+
}
30+
31+
json {
32+
source => "[parsed_message][logx][aws][message]"
33+
target => "[logx][aws]"
34+
}
35+
36+
mutate {
37+
rename => { "[logx][aws][eventVersion]" => "[logx][aws][eventVersion]"}
38+
rename => { "[logx][aws][userIdentity][accountId]" => "[logx][aws][accountId]"}
39+
rename => { "[logx][aws][userIdentity][sessionContext][attributes][creationDate]" => "[logx][aws][creationDate]"}
40+
rename => { "[logx][aws][userIdentity][sessionContext][sessionIssuer][accountId]" => "[logx][aws][sessionIssuerAccountId]"}
41+
rename => { "[logx][aws][userIdentity][sessionContext][sessionIssuer][arn]" => "[logx][aws][sessionIssuerArn]"}
42+
rename => { "[logx][aws][userIdentity][sessionContext][sessionIssuer][principalId]" => "[logx][aws][sessionIssuerPrincipalId]"}
43+
rename => { "[logx][aws][userIdentity][sessionContext][sessionIssuer][type]" => "[logx][aws][sessionIssuerType]"}
44+
rename => { "[logx][aws][additionalEventData][SignatureVersion]" => "[logx][aws][SignatureVersion]"}
45+
rename => { "[logx][aws][additionalEventData][x-amz-id-2]" => "[logx][aws][xamzId2]"}
46+
rename => { "[logx][aws][responseElements][x-amz-expiration]" => "[logx][aws][xAmzExpiration]"}
47+
}
48+
49+
mutate {
50+
remove_field => ["headers", "parsed_message", "@version"]
51+
}
52+
}
53+
}'
54+
WHERE id=101;
55+
]]>
56+
</sql>
57+
</changeSet>
58+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/changelog/20250515003_update_filter_o365.xml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20250515003" author="JocLRojas">
8+
9+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
10+
<![CDATA[
11+
12+
UPDATE public.utm_logstash_filter
13+
SET filter_version='2.0.0',
14+
logstash_filter='filter {
15+
16+
# Office 365 version 2.0.0
17+
18+
json {
19+
source => "message"
20+
}
21+
22+
if ([dataType] == "o365") {
23+
24+
mutate {
25+
rename => {"[logx][tenant]" => "[logx][o365][tenant]"}
26+
}
27+
28+
mutate {
29+
remove_field => ["headers", "@version", "global"]
30+
}
31+
}
32+
}'
33+
WHERE id=601;
34+
]]>
35+
</sql>
36+
</changeSet>
37+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/changelog/20250516001_udpate_sophos_name.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20250516001" author="Manuel">
8+
<sql>
9+
UPDATE utm_module
10+
set pretty_name = 'Sophos Firewall'
11+
WHERE id = 30;
12+
</sql>
13+
</changeSet>
14+
15+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/master.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,5 +97,11 @@
9797

9898
<include file="/config/liquibase/changelog/20250507003_add_o365_pipeline.xml" relativeToChangelogFile="false"/>
9999

100+
<include file="/config/liquibase/changelog/20250515001_update_filter_aws.xml" relativeToChangelogFile="false"/>
101+
102+
<include file="/config/liquibase/changelog/20250515003_update_filter_o365.xml" relativeToChangelogFile="false"/>
103+
104+
<include file="/config/liquibase/changelog/20250516001_udpate_sophos_name.xml" relativeToChangelogFile="false"/>
105+
100106

101107
</databaseChangeLog>

‎filters/aws/aws.conf‎

Lines changed: 29 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,40 @@
11
filter {
2-
if ([logx][type] and [logx][type] == "aws") {
2+
3+
# Amazon Web Service version 2.0.0
4+
5+
json {
6+
source => "message"
7+
target => "parsed_message"
8+
}
9+
10+
if ([parsed_message][logx][type] == "aws") {
311
mutate {
412
add_field => {
513
"dataType" => "aws"
6-
}
7-
add_field => {
8-
"dataSource" => "aws"
14+
"dataSource" => "%{[parsed_message][logx][tenant]}"
915
}
1016
}
1117

12-
if [logx][aws][message] {
13-
14-
grok {
15-
match => {"[logx][aws][message]" => "%{GREEDYDATA:b} %{IP:src_ip} %{IP:dest_ip} %{BASE10NUM:src_port} %{BASE10NUM:dest_port} %{GREEDYDATA:a} %{GREEDYDATA:c} %{WORD:action} %{GREEDYDATA:message_text}"}
16-
}
17-
18-
if [message_text] {
19-
mutate {
20-
rename => {
21-
"message_text" => "[logx][aws][details][message_text]"
22-
}
23-
}
24-
}
25-
if [action] {
26-
mutate {
27-
rename => {
28-
"action" => "[logx][aws][details][action]"
29-
}
30-
}
31-
}
32-
if [src_port] {
33-
mutate {
34-
rename => {
35-
"src_port" => "[logx][aws][details][src_port]"
36-
}
37-
}
38-
}
39-
if [dest_ip] {
40-
mutate {
41-
rename => {
42-
"dest_ip" => "[logx][aws][details][dest_ip]"
43-
}
44-
}
45-
}
46-
if [src_ip] {
47-
mutate {
48-
rename => {
49-
"src_ip" => "[logx][aws][details][src_ip]"
50-
}
51-
}
52-
}
53-
if [dest_port] {
54-
mutate {
55-
rename => {
56-
"dest_port" => "[logx][aws][details][dest_port]"
57-
}
58-
}
59-
}
60-
61-
}
62-
18+
json {
19+
source => "[parsed_message][logx][aws][message]"
20+
target => "[logx][aws]"
21+
}
6322

6423
mutate {
65-
remove_field => ["headers", "[logx][type]", "@version", "global", "es_metadata_id","a","b","c"]
24+
rename => { "[logx][aws][eventVersion]" => "[logx][aws][eventVersion]"}
25+
rename => { "[logx][aws][userIdentity][accountId]" => "[logx][aws][accountId]"}
26+
rename => { "[logx][aws][userIdentity][sessionContext][attributes][creationDate]" => "[logx][aws][creationDate]"}
27+
rename => { "[logx][aws][userIdentity][sessionContext][sessionIssuer][accountId]" => "[logx][aws][sessionIssuerAccountId]"}
28+
rename => { "[logx][aws][userIdentity][sessionContext][sessionIssuer][arn]" => "[logx][aws][sessionIssuerArn]"}
29+
rename => { "[logx][aws][userIdentity][sessionContext][sessionIssuer][principalId]" => "[logx][aws][sessionIssuerPrincipalId]"}
30+
rename => { "[logx][aws][userIdentity][sessionContext][sessionIssuer][type]" => "[logx][aws][sessionIssuerType]"}
31+
rename => { "[logx][aws][additionalEventData][SignatureVersion]" => "[logx][aws][SignatureVersion]"}
32+
rename => { "[logx][aws][additionalEventData][x-amz-id-2]" => "[logx][aws][xamzId2]"}
33+
rename => { "[logx][aws][responseElements][x-amz-expiration]" => "[logx][aws][xAmzExpiration]"}
34+
}
35+
36+
mutate {
37+
remove_field => ["headers", "parsed_message", "@version"]
6638
}
6739
}
68-
}
40+
}

‎filters/office365/o365-all.conf‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,19 @@
11
filter {
2-
if [logx][type] and [logx][type] == "o365" {
2+
3+
# Office 365 version 2.0.0
4+
5+
json {
6+
source => "message"
7+
}
8+
9+
if ([dataType] == "o365") {
10+
311
mutate {
4-
add_field => {
5-
"dataType" => "o365"
6-
}
7-
add_field => {
8-
"dataSource" => "o365"
9-
}
12+
rename => {"[logx][tenant]" => "[logx][o365][tenant]"}
1013
}
1114

1215
mutate {
13-
remove_field => ["headers", "[logx][type]", "@version", "global", "es_metadata_id"]
16+
remove_field => ["headers", "@version", "global"]
1417
}
15-
1618
}
1719
}

‎filters/sophos/sophos_central.conf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
filter {
2+
3+
# Sophos_Central version 1.0.0
4+
5+
json {
6+
source => "message"
7+
}
8+
9+
if ([dataType] == "sophos-central") {
10+
11+
mutate {
12+
rename => { "[logx][sophos_central][source_info][ip]" => "[logx][sophos_central][source_ip]"}
13+
rename => { "[logx][sophos_central][when]" => "[logx][sophos_central][timestamp_occurred_at]"}
14+
rename => { "[logx][sophos_central][created_at]" => "[logx][sophos_central][timestamp_generated_at]"}
15+
}
16+
17+
mutate {
18+
remove_field => ["headers", "@version", "global", "[logx][sophos_central][core_remedy_items][totalItems]"]
19+
}
20+
}
21+
}

0 commit comments

Comments
 (0)