fortinet_fortigate: Include NAT and firewall IPs in related.ip (#5389)

elastic · Mar 20, 2023 · 28e998b · 28e998b
1 parent 500d6c8
commit 28e998b
Show file tree

Hide file tree

Showing 4 changed files with 36 additions and 2 deletions.
diff --git a/packages/fortinet_fortigate/changelog.yml b/packages/fortinet_fortigate/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.8.0"
+  changes:
+    - description: Include NAT and firewall IPs in `related.ip`.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/5389
 - version: "1.7.0"
   changes:
     - description: Handle broader range of timezone formats.

diff --git a/...ges/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet.log-expected.json b/...ges/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet.log-expected.json
@@ -1906,6 +1906,9 @@
                 "vendor": "Fortinet"
             },
             "related": {
+                "ip": [
+                    "172.16.0.2"
+                ],
                 "user": [
                     "elastico"
                 ]
@@ -2064,7 +2067,8 @@
             },
             "related": {
                 "ip": [
-                    "67.43.156.13"
+                    "67.43.156.13",
+                    "10.10.10.10"
                 ],
                 "user": [
                     "someuser"

diff --git a/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/default.yml
@@ -432,6 +432,31 @@ processors:
       value: "{{destination.nat.ip}}"
       if: "ctx.destination?.nat?.ip != null"
       allow_duplicates: false
+  - append:
+      field: related.ip
+      value: "{{source.nat.ip}}"
+      allow_duplicates: false
+      if: "ctx.source?.nat?.ip != null"
+  - append:
+      field: related.ip
+      value: "{{destination.nat.ip}}"
+      allow_duplicates: false
+      if: "ctx.destination?.nat?.ip != null"
+  - append:
+      field: related.ip
+      value: "{{fortinet.firewall.ip}}"
+      allow_duplicates: false
+      if: "ctx.fortinet?.firewall?.ip != null"
+  - append:
+      field: related.ip
+      value: "{{fortinet.firewall.assignip}}"
+      allow_duplicates: false
+      if: "ctx.fortinet?.firewall?.assignip != null"
+  - append:
+      field: related.ip
+      value: "{{fortinet.firewall.tunnelip}}"
+      allow_duplicates: false
+      if: "ctx.fortinet?.firewall?.tunnelip != null"
   - append:
       field: related.user
       value: "{{source.user.name}}"

diff --git a/packages/fortinet_fortigate/manifest.yml b/packages/fortinet_fortigate/manifest.yml
@@ -1,6 +1,6 @@
 name: fortinet_fortigate
 title: Fortinet FortiGate Firewall Logs
-version: "1.7.0"
+version: "1.8.0"
 release: ga
 description: Collect logs from Fortinet FortiGate firewalls with Elastic Agent.
 type: integration