Skip to content

Commit

Permalink
[tenable_io] Resolve the bugs (#6281)
Browse files Browse the repository at this point in the history
* Resolve the bugs

* Update the changelog entry

* Resolve the comments
  • Loading branch information
brijesh-elastic committed May 22, 2023
1 parent 403363c commit fabb0f4
Show file tree
Hide file tree
Showing 26 changed files with 1,027 additions and 328 deletions.
22 changes: 11 additions & 11 deletions packages/tenable_io/_dev/deploy/docker/files/config.yml
Expand Up @@ -62,14 +62,14 @@ rules:
methods: ["GET"]
responses:
- status_code: 200
body: |
{
"scans": [
{"control":true,"creation_date":1683282785,"enabled":true,"id":195,"last_modification_date":1683283158,"legacy":false,"name":"Client Discovery","owner":"jdoe@contoso.com","policy_id":194,"read":false,"rrules":"FREQ=WEEKLY;INTERVAL=1;BYDAY=FR","schedule_uuid":"11c56dea-as5f-65ce-ad45-9978045df65ecade45b6e3a76871","shared":true,"starttime":"20220708T033000","status":"completed","template_uuid":"a1efc3b4-cd45-a65d-fbc4-0079ebef4a56cd32a05ec2812bcf","timezone":"America/Los_Angeles","has_triggers":false,"type":"remote","permissions":128,"user_permissions":128,"uuid":"a456ef1c-cbd4-ad41-f654-119b766ff61f","wizard_uuid":"32cbd657-fe65-a45e-a45f-0079eb89e56a1c23fd5ec2812bcf","progress":100,"total_targets":21,"status_times":{"initializing":2623,"pending":52799,"processing":1853,"publishing":300329,"running":15759}},
{"control":true,"creation_date":1683043551,"enabled":true,"id":423,"last_modification_date":1683049400,"legacy":false,"name":"Client Vulnerabiltiy Scan Group B","owner":"jdoe@contoso.com","policy_id":422,"read":false,"rrules":"FREQ=WEEKLY;INTERVAL=1;BYDAY=TU","schedule_uuid":"1d63c64e-a5d1-df57-0ecf-9f0e288d8a45fe84bcd54e39daaf","shared":true,"starttime":"20220714T090000","status":"completed","template_uuid":"731a8e52-3ea6-a291-ec0a-d2ff0d8af595bcd788d6be818b65","timezone":"America/Los_Angeles","has_triggers":false,"type":"remote","permissions":128,"user_permissions":128,"uuid":"a2389003-fec1-a45d-a45d-aece258c4133","wizard_uuid":"731a8e52-a4d5-54f2-acd4-d2ffd7afec9645d788d6be818b65","progress":100,"total_targets":2538,"status_times":{"initializing":6099,"pending":57966,"processing":393,"publishing":240537,"running":5544031}}
],
"folders": [
{"id":227,"name":"Cloud Audit Scans","type":"custom","custom":1,"unread_count":0,"default_tag":0},
{"id":226,"name":"Targeted Scans","type":"custom","custom":1,"unread_count":0,"default_tag":0}
]
}
body: |-
{
"scans": [
{"control":true,"creation_date":1683282785,"enabled":true,"id":195,"last_modification_date":1683283158,"legacy":false,"name":"Client Discovery","owner":"jdoe@contoso.com","policy_id":194,"read":false,"rrules":"FREQ=WEEKLY;INTERVAL=1;BYDAY=FR","schedule_uuid":"11c56dea-as5f-65ce-ad45-9978045df65ecade45b6e3a76871","shared":true,"starttime":"20220708T033000","status":"completed","template_uuid":"a1efc3b4-cd45-a65d-fbc4-0079ebef4a56cd32a05ec2812bcf","timezone":"America/Los_Angeles","has_triggers":false,"type":"remote","permissions":128,"user_permissions":128,"uuid":"a456ef1c-cbd4-ad41-f654-119b766ff61f","wizard_uuid":"32cbd657-fe65-a45e-a45f-0079eb89e56a1c23fd5ec2812bcf","progress":100,"total_targets":21,"status_times":{"initializing":2623,"pending":52799,"processing":1853,"publishing":300329,"running":15759}},
{"control":true,"creation_date":1683043551,"enabled":true,"id":423,"last_modification_date":1683049400,"legacy":false,"name":"Client Vulnerabiltiy Scan Group B","owner":"jdoe@contoso.com","policy_id":422,"read":false,"rrules":"FREQ=WEEKLY;INTERVAL=1;BYDAY=TU","schedule_uuid":"1d63c64e-a5d1-df57-0ecf-9f0e288d8a45fe84bcd54e39daaf","shared":true,"starttime":"20220714T090000","status":"completed","template_uuid":"731a8e52-3ea6-a291-ec0a-d2ff0d8af595bcd788d6be818b65","timezone":"America/Los_Angeles","has_triggers":false,"type":"remote","permissions":128,"user_permissions":128,"uuid":"a2389003-fec1-a45d-a45d-aece258c4133","wizard_uuid":"731a8e52-a4d5-54f2-acd4-d2ffd7afec9645d788d6be818b65","progress":100,"total_targets":2538,"status_times":{"initializing":6099,"pending":57966,"processing":393,"publishing":240537,"running":5544031}}
],
"folders": [
{"id":227,"name":"Cloud Audit Scans","type":"custom","custom":1,"unread_count":0,"default_tag":0},
{"id":226,"name":"Targeted Scans","type":"custom","custom":1,"unread_count":0,"default_tag":0}
]
}
5 changes: 5 additions & 0 deletions packages/tenable_io/changelog.yml
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "0.6.1"
changes:
- description: Resolve customer suggested bugs.
type: bugfix
link: https://github.com/elastic/integrations/pull/6281
- version: "0.6.0"
changes:
- description: Added datasets for scanner and scan logs.
Expand Down
Expand Up @@ -25,16 +25,16 @@
]
},
"host": {
"domain": [
"example.com"
],
"id": "95c2725c-7298-4a44-8a1d-63131ca3f01f",
"ip": [
"89.160.20.112"
],
"mac": [
"00-00-5E-00-53-00",
"00-00-5E-00-53-FF"
],
"name": [
"example.com"
]
},
"related": {
Expand Down
Expand Up @@ -22,7 +22,7 @@ request.transforms:
# Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header
# NOTE: The "Build" version must be kept in sync with this package's version.
target: header.User-Agent
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.5.0)"]]'
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.6.1)"]]'
- set:
target: header.X-ApiKeys
value: 'accessKey={{access_key}}; secretKey={{secret_key}};'
Expand Down Expand Up @@ -59,7 +59,7 @@ chain:
# Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header
# NOTE: The "Build" version must be kept in sync with this package's version.
target: header.User-Agent
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.4.0)"]]'
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.6.1)"]]'
- set:
target: header.X-ApiKeys
value: 'accessKey={{access_key}}; secretKey={{secret_key}};'
Expand All @@ -84,7 +84,7 @@ chain:
# Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header
# NOTE: The "Build" version must be kept in sync with this package's version.
target: header.User-Agent
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.4.0)"]]'
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.6.1)"]]'
- set:
target: header.X-ApiKeys
value: 'accessKey={{access_key}}; secretKey={{secret_key}};'
Expand Down
Expand Up @@ -20,13 +20,6 @@ processors:
- json:
field: event.original
target_field: json
- fingerprint:
fields:
- json.id
- json.created_at
- json.updated_at
target_field: _id
ignore_missing: true
- date:
field: json.created_at
target_field: tenable_io.asset.created_at
Expand Down Expand Up @@ -296,7 +289,7 @@ processors:
target_field: tenable_io.asset.fqdns
ignore_missing: true
- set:
field: host.name
field: host.domain
copy_from: tenable_io.asset.fqdns
ignore_empty_value: true
- gsub:
Expand Down Expand Up @@ -324,9 +317,12 @@ processors:
target_field: tenable_io.asset.netbios_names
ignore_missing: true
- set:
field: host.domain
field: host.name
copy_from: tenable_io.asset.netbios_names
ignore_empty_value: true
- lowercase:
field: host.name
ignore_missing: true
- rename:
field: json.operating_systems
target_field: tenable_io.asset.operating_systems
Expand Down
20 changes: 10 additions & 10 deletions packages/tenable_io/data_stream/asset/sample_event.json
@@ -1,11 +1,11 @@
{
"@timestamp": "2018-12-31T22:27:58.599Z",
"agent": {
"ephemeral_id": "7b858d29-9cae-4b12-be0e-195bb63bd368",
"id": "f6749a44-63dc-46f2-88a7-1808edaa4d1b",
"ephemeral_id": "78a2f828-16dd-4dd3-bc81-ed86c17e80d7",
"id": "0791a1ea-4606-45a6-9528-d1a202b6a144",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.6.0"
"version": "8.7.1"
},
"cloud": {
"availability_zone": "12",
Expand All @@ -25,35 +25,35 @@
"version": "8.7.0"
},
"elastic_agent": {
"id": "f6749a44-63dc-46f2-88a7-1808edaa4d1b",
"id": "0791a1ea-4606-45a6-9528-d1a202b6a144",
"snapshot": false,
"version": "8.6.0"
"version": "8.7.1"
},
"event": {
"agent_id_status": "verified",
"category": [
"host"
],
"created": "2023-03-27T13:45:28.882Z",
"created": "2023-05-17T12:41:04.186Z",
"dataset": "tenable_io.asset",
"ingested": "2023-03-27T13:45:32Z",
"ingested": "2023-05-17T12:41:05Z",
"kind": "state",
"original": "{\"acr_score\":\"3\",\"agent_names\":[],\"agent_uuid\":\"22\",\"aws_availability_zone\":null,\"aws_ec2_instance_ami_id\":\"12\",\"aws_ec2_instance_group_name\":null,\"aws_ec2_instance_id\":\"12\",\"aws_ec2_instance_state_name\":null,\"aws_ec2_instance_type\":null,\"aws_ec2_name\":null,\"aws_ec2_product_code\":null,\"aws_owner_id\":\"44\",\"aws_region\":null,\"aws_subnet_id\":null,\"aws_vpc_id\":null,\"azure_resource_id\":\"12\",\"azure_vm_id\":\"12\",\"bigfix_asset_id\":null,\"bios_uuid\":\"33\",\"created_at\":\"2017-12-31T20:40:44.535Z\",\"deleted_at\":\"2017-12-31T20:40:44.535Z\",\"deleted_by\":\"user\",\"exposure_score\":\"721\",\"first_scan_time\":\"2017-12-31T20:40:23.447Z\",\"first_seen\":\"2017-12-31T20:40:23.447Z\",\"fqdns\":[\"example.com\"],\"gcp_instance_id\":\"12\",\"gcp_project_id\":\"12\",\"gcp_zone\":\"12\",\"has_agent\":false,\"has_plugin_results\":true,\"hostnames\":[],\"id\":\"95c2725c-7298-4a44-8a1d-63131ca3f01f\",\"installed_software\":[\"cpe:/a:test:xyz:12.8\",\"cpe:/a:test:abc:7.7.3\",\"cpe:/a:test:pqr:6.9\",\"cpe:/a:test:xyz\"],\"ipv4s\":[\"89.160.20.112\"],\"ipv6s\":[],\"last_authenticated_scan_date\":\"2017-12-31T20:40:44.535Z\",\"last_licensed_scan_date\":\"2018-12-31T22:27:52.869Z\",\"last_scan_id\":\"00283024-afee-44ea-b467-db5a6ed9fd50ab8f7ecb158c480e\",\"last_scan_time\":\"2018-03-31T22:27:52.869Z\",\"last_schedule_id\":\"72284901-7c68-42b2-a0c4-c1e75568849df60557ee0e264228\",\"last_seen\":\"2018-12-31T22:27:52.869Z\",\"mac_addresses\":[],\"manufacturer_tpm_ids\":[],\"mcafee_epo_agent_guid\":null,\"mcafee_epo_guid\":null,\"netbios_names\":[],\"network_interfaces\":[{\"fqdns\":[\"example.com\"],\"ipv4s\":[\"89.160.20.112\",\"81.2.69.144\"],\"ipv6s\":[\"2a02:cf40::\"],\"mac_addresses\":[\"00-00-5E-00-53-00\",\"00-00-5E-00-53-FF\"],\"name\":\"test.0.1234\"}],\"operating_systems\":[],\"qualys_asset_ids\":[],\"qualys_host_ids\":[],\"servicenow_sysid\":null,\"sources\":[{\"first_seen\":\"2017-12-31T20:40:23.447Z\",\"last_seen\":\"2018-12-31T22:27:52.869Z\",\"name\":\"TEST_SCAN\"}],\"ssh_fingerprints\":[],\"symantec_ep_hardware_keys\":[],\"system_types\":[],\"tags\":[{\"added_at\":\"2018-12-31T14:53:13.817Z\",\"added_by\":\"ac2e7ef6-fac9-47bf-9170-617331322885\",\"key\":\"Geographic Area\",\"uuid\":\"47e7f5f6-1013-4401-a705-479bfadc7826\",\"value\":\"APAC\"}],\"terminated_at\":\"2017-12-31T20:40:44.535Z\",\"terminated_by\":\"user\",\"updated_at\":\"2018-12-31T22:27:58.599Z\"}",
"type": [
"info"
]
},
"host": {
"domain": [
"example.com"
],
"id": "95c2725c-7298-4a44-8a1d-63131ca3f01f",
"ip": [
"89.160.20.112"
],
"mac": [
"00-00-5E-00-53-00",
"00-00-5E-00-53-FF"
],
"name": [
"example.com"
]
},
"input": {
Expand Down
Expand Up @@ -21,7 +21,7 @@ request.transforms:
# Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header
# NOTE: The "Build" version must be kept in sync with this package's version.
target: header.User-Agent
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.5.0)"]]'
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.6.1)"]]'
- set:
target: header.X-ApiKeys
value: 'accessKey={{access_key}}; secretKey={{secret_key}};'
Expand Down
Expand Up @@ -22,13 +22,6 @@ processors:
target_field: json
- drop:
if: ctx.json?.data?.plugin_details != null && ctx.json.data.plugin_details.isEmpty()
- fingerprint:
fields:
- json.id
- json.attributes.plugin_modification_date
- json.attributes.plugin_publication_date
target_field: _id
ignore_missing: true
- convert:
field: json.id
target_field: tenable_io.plugin.id
Expand Down
14 changes: 7 additions & 7 deletions packages/tenable_io/data_stream/plugin/sample_event.json
@@ -1,11 +1,11 @@
{
"@timestamp": "2018-07-19T00:00:00.000Z",
"agent": {
"ephemeral_id": "47078a4d-6a1e-4176-abd6-16c5ac49f503",
"id": "f6749a44-63dc-46f2-88a7-1808edaa4d1b",
"ephemeral_id": "78a2f828-16dd-4dd3-bc81-ed86c17e80d7",
"id": "0791a1ea-4606-45a6-9528-d1a202b6a144",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.6.0"
"version": "8.7.1"
},
"data_stream": {
"dataset": "tenable_io.plugin",
Expand All @@ -16,15 +16,15 @@
"version": "8.7.0"
},
"elastic_agent": {
"id": "f6749a44-63dc-46f2-88a7-1808edaa4d1b",
"id": "0791a1ea-4606-45a6-9528-d1a202b6a144",
"snapshot": false,
"version": "8.6.0"
"version": "8.7.1"
},
"event": {
"agent_id_status": "verified",
"created": "2023-03-27T13:46:13.619Z",
"created": "2023-05-17T12:41:34.273Z",
"dataset": "tenable_io.plugin",
"ingested": "2023-03-27T13:46:17Z",
"ingested": "2023-05-17T12:41:35Z",
"kind": "state",
"original": "{\"attributes\":{\"cpe\":[\"p-cpe:/a:fedoraproject:fedora:kernel-source\",\"cpe:/o:fedoraproject:fedora_core:1\",\"p-cpe:/a:fedoraproject:fedora:kernel-BOOT\",\"p-cpe:/a:fedoraproject:fedora:kernel-debuginfo\",\"p-cpe:/a:fedoraproject:fedora:kernel\",\"p-cpe:/a:fedoraproject:fedora:kernel-doc\",\"p-cpe:/a:fedoraproject:fedora:kernel-smp\"],\"cve\":[\"CVE-2003-0984\"],\"cvss3_base_score\":0,\"cvss3_temporal_score\":0,\"cvss_base_score\":4.6,\"cvss_temporal_score\":0,\"cvss_vector\":{\"AccessComplexity\":\"Low\",\"AccessVector\":\"Local-access\",\"Authentication\":\"None required\",\"Availability-Impact\":\"Partial\",\"Confidentiality-Impact\":\"Partial\",\"Integrity-Impact\":\"Partial\",\"raw\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\"},\"default_account\":false,\"description\":\"Various RTC drivers had the potential to leak...\",\"exploit_available\":false,\"exploit_framework_canvas\":false,\"exploit_framework_core\":false,\"exploit_framework_d2_elliot\":false,\"exploit_framework_exploithub\":false,\"exploit_framework_metasploit\":false,\"exploited_by_malware\":false,\"exploited_by_nessus\":false,\"has_patch\":true,\"in_the_news\":false,\"malware\":false,\"patch_publication_date\":\"2004-01-07T00:00:00Z\",\"plugin_modification_date\":\"2018-07-19T00:00:00Z\",\"plugin_publication_date\":\"2004-07-23T00:00:00Z\",\"plugin_type\":\"local\",\"plugin_version\":\"1.17\",\"risk_factor\":\"Medium\",\"see_also\":[\"http://example.com/u?07bc9e7f\"],\"solution\":\"Update the affected packages.\",\"synopsis\":\"The remote Fedora Core host is missing a security update.\",\"unsupported_by_vendor\":false,\"vpr\":{\"drivers\":{\"age_of_vuln\":{\"lower_bound\":366,\"upper_bound\":730},\"cvss3_impact_score\":5.9,\"cvss_impact_score_predicted\":false,\"exploit_code_maturity\":\"UNPROVEN\",\"product_coverage\":\"LOW\",\"threat_intensity_last28\":\"VERY_LOW\",\"threat_recency\":{\"lower_bound\":366,\"upper_bound\":730},\"threat_sources_last28\":[\"No recorded events\"]},\"score\":5.5,\"updated\":\"2018-07-19T00:00:00Z\"},\"xref\":[\"FEDORA:2003-047\"],\"xrefs\":[{\"id\":\"2003-047\",\"type\":\"FEDORA\"}]},\"id\":13670,\"name\":\"Fedora Core 1 : kernel-2.4.22-1.2140.nptl (2003-047)\"}",
"type": [
Expand Down
Expand Up @@ -4,4 +4,4 @@ fields:
- preserve_duplicate_custom_fields
dynamic_fields:
"@timestamp": ".*"
event.ingested: ".*"
event.ingested: ".*"
Expand Up @@ -18,7 +18,7 @@ request.transforms:
# Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header
# NOTE: The "Build" version must be kept in sync with this package's version.
target: header.User-Agent
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.5.0)"]]'
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.6.1)"]]'
- set:
target: header.X-ApiKeys
value: 'accessKey={{access_key}}; secretKey={{secret_key}};'
Expand Down
2 changes: 1 addition & 1 deletion packages/tenable_io/data_stream/scan/fields/ecs.yml
Expand Up @@ -15,4 +15,4 @@
- external: ecs
name: related.ip
- external: ecs
name: tags
name: tags
Expand Up @@ -4,4 +4,4 @@ fields:
- preserve_duplicate_custom_fields
dynamic_fields:
"@timestamp": ".*"
event.ingested: ".*"
event.ingested: ".*"
Expand Up @@ -18,7 +18,7 @@ request.transforms:
# Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header
# NOTE: The "Build" version must be kept in sync with this package's version.
target: header.User-Agent
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.5.0)"]]'
value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.6.1)"]]'
- set:
target: header.X-ApiKeys
value: 'accessKey={{access_key}}; secretKey={{secret_key}};'
Expand Down
Empty file.
2 changes: 1 addition & 1 deletion packages/tenable_io/data_stream/scanner/fields/ecs.yml
Expand Up @@ -15,4 +15,4 @@
- external: ecs
name: related.ip
- external: ecs
name: tags
name: tags
Expand Up @@ -16,12 +16,12 @@
]
},
"host": {
"domain": "example.com",
"id": "cf165808-6a31-48e1-9cf3-c6c3174df51d",
"ip": [
"89.160.20.112",
"81.2.69.142"
],
"name": "example.com",
"os": {
"full": [
"Apple Mac OS X 10.5.8"
Expand All @@ -45,7 +45,7 @@
"vulnerability": {
"asset": {
"fqdn": "example.com",
"hostname": "89.160.20.112",
"ip_address": "89.160.20.112",
"ipv4": "81.2.69.142",
"network_id": "00000000-0000-0000-0000-000000000000",
"operating_system": [
Expand Down

0 comments on commit fabb0f4

Please sign in to comment.