Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Cisco ASA] Add support for SIP events #1865

Merged
merged 10 commits into from
Oct 11, 2021
Merged

[Cisco ASA] Add support for SIP events #1865

merged 10 commits into from
Oct 11, 2021

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented Oct 5, 2021 •
edited
Loading

What does this PR do?

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Author's Checklist

  • Sanity check expected output.

How to test this PR locally

cd github.com/elastic/integrations/packages/cisco_asa; elastic-package test pipeline

Related issues

Screenshots

N/A

@efd6 efd6 added enhancement New feature or request Integration:Cisco labels Oct 5, 2021
@efd6 efd6 requested a review from P1llus October 5, 2021 09:24
@elasticmachine
Copy link

elasticmachine commented Oct 5, 2021 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2021-10-11T10:54:58.486+0000

  • Duration: 15 min 29 sec

  • Commit: c4243bb

Test stats 🧪

Test Results
Failed 0
Passed 25
Skipped 0
Total 25

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@efd6
Copy link
Contributor Author

efd6 commented Oct 5, 2021

/test

1 similar comment
@efd6
Copy link
Contributor Author

efd6 commented Oct 5, 2021

/test

@jamiehynds
Copy link

@efd6 just a heads up that we have a set of proposed SIP fields in ECS, which are worth checking out incase any of the fields are relevant to these Cisco events. https://github.com/elastic/ecs/blob/master/rfcs/text/0011-sip-fields.md

@marc-gr implemented SIP support in Packetbeat and may have some input.

@efd6
Copy link
Contributor Author

efd6 commented Oct 5, 2021

It is probably worth mirroring the addresses and port into sip.{from,to}. It doesn't look like the remainder map well to that scheme, but I'll wait for further input.

@efd6 efd6 marked this pull request as ready for review October 6, 2021 21:21
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

legoguy1000
legoguy1000 reviewed Oct 9, 2021
View reviewed changes
packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated
description: "607001"
field: "_temp_.cisco.connection_type"
patterns:
- "%{PROTOCOLS:network.transport}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RTP and RTCP are not transport protocols, they're layer 7 so would belong in network.protocol

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. Fixed.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd combine those into a single grok processor. No reason to break it up.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. Is this better?

P1llus
P1llus approved these changes Oct 11, 2021
View reviewed changes
Copy link
Member

@P1llus P1llus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small comment and LGTM :)

packages/cisco_asa/changelog.yml Outdated
@@ -19,3 +19,6 @@
- description: Split Cisco ASA into its own package
type: enhancement
link: https://github.com/elastic/integrations/pull/1583
- description: Add support for Cisco ASA SIP events
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add your own changelog entry and bump the version in changelog.yml and the manifest? I think its better that we differentiate between them, rather than trying to put them under the same version

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

@efd6 efd6 merged commit 9dd4d02 into elastic:master Oct 11, 2021
@efd6 efd6 deleted the cisco_asa/sip branch October 11, 2021 11:35
eyalkraft pushed a commit to build-security/integrations that referenced this pull request Mar 30, 2022
@efd6
[Cisco ASA] Add support for SIP events (elastic#1865)
9e33e64
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dainperkins dainperkins dainperkins left review comments

@legoguy1000 legoguy1000 legoguy1000 left review comments

@P1llus P1llus P1llus approved these changes

Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Support for Cisco ASA SIP events
6 participants
@efd6 @elasticmachine @jamiehynds @P1llus @legoguy1000 @dainperkins