elastic · r00tu53r · Jan 25, 2022 · Jan 2, 2022 · Jan 4, 2022 · Jan 6, 2022
@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@1.12
+    reference: git@8.0
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.4.0"
+  changes:
+    - description: Update to ECS 8.0
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/2428
 - version: "1.3.2"
   changes:
     - description: Regenerate test files using the new GeoIP database

@@ -6,7 +6,7 @@ processors:
       value: "{{_ingest.timestamp}}"
   - set:
       field: ecs.version
-      value: '1.12.0'
+      value: '8.0.0'
   - rename:
       field: message
       target_field: event.original

@@ -1,12 +1,11 @@
 {
     "@timestamp": "2020-02-14T20:18:57.718Z",
     "agent": {
-        "ephemeral_id": "c8d18964-83d3-4be1-809c-201de8688e6b",
-        "hostname": "docker-fleet-agent",
-        "id": "62554406-4558-40ed-9cd2-c68d978882ff",
+        "ephemeral_id": "c8876910-3340-483c-b925-cde50a8e9810",
+        "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "7.13.0"
+        "version": "8.0.0-beta1"
     },
     "client": {
         "geo": {
@@ -30,23 +29,24 @@
         "type": "logs"
     },
     "ecs": {
-        "version": "1.9.0"
+        "version": "8.0.0"
     },
     "elastic_agent": {
-        "id": "52c5ef7a-f604-488a-b39c-4ab431eb930e",
-        "snapshot": true,
-        "version": "7.13.0"
+        "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba",
+        "snapshot": false,
+        "version": "8.0.0-beta1"
     },
     "event": {
         "action": "user.session.start",
+        "agent_id_status": "verified",
         "category": [
             "authentication",
             "session"
         ],
-        "created": "2021-05-31T10:31:04.833Z",
+        "created": "2022-01-02T03:56:11.567Z",
         "dataset": "okta.system",
         "id": "3aeede38-4f67-11ea-abd3-1f5d113f2546",
-        "ingested": "2021-05-31T10:31:05.861084700Z",
+        "ingested": "2022-01-02T03:56:12Z",
         "kind": "event",
         "original": "{\"actor\":{\"alternateId\":\"xxxxxx@elastic.co\",\"detailEntry\":null,\"displayName\":\"xxxxxx\",\"id\":\"00u1abvz4pYqdM8ms4x6\",\"type\":\"User\"},\"authenticationContext\":{\"authenticationProvider\":null,\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":null,\"externalSessionId\":\"102bZDNFfWaQSyEZQuDgWt-uQ\",\"interface\":null,\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"108.255.197.247\",\"userAgent\":{\"browser\":\"FIREFOX\",\"os\":\"Mac OS X\",\"rawUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"deviceFingerprint\":\"541daf91d15bef64a7e08c946fd9a9d0\",\"requestId\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"requestUri\":\"/api/v1/authn\",\"threatSuspected\":\"false\",\"url\":\"/api/v1/authn?\"}},\"displayMessage\":\"User login to Okta\",\"eventType\":\"user.session.start\",\"legacyEventType\":\"core.user_auth.login_success\",\"outcome\":{\"reason\":null,\"result\":\"SUCCESS\"},\"published\":\"2020-02-14T20:18:57.718Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"ip\":\"108.255.197.247\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":null,\"asOrg\":null,\"domain\":null,\"isProxy\":null,\"isp\":null},\"severity\":\"INFO\",\"target\":null,\"transaction\":{\"detail\":{},\"id\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"type\":\"WEB\"},\"uuid\":\"3aeede38-4f67-11ea-abd3-1f5d113f2546\",\"version\":\"0\"}",
         "outcome": "success",
@@ -55,9 +55,6 @@
             "user"
         ]
     },
-    "host": {
-        "name": "docker-fleet-agent"
-    },
     "input": {
         "type": "httpjson"
     },
@@ -111,33 +108,16 @@
         ]
     },
     "source": {
-        "as": {
-            "number": 7018,
-            "organization": {
-                "name": "AT\u0026T Services, Inc."
-            }
-        },
-        "geo": {
-            "city_name": "Dublin",
-            "continent_name": "North America",
-            "country_iso_code": "US",
-            "country_name": "United States",
-            "location": {
-                "lat": 37.7201,
-                "lon": -121.919
-            },
-            "region_iso_code": "US-CA",
-            "region_name": "California"
-        },
         "ip": "108.255.197.247",
         "user": {
             "full_name": "xxxxxx",
             "id": "00u1abvz4pYqdM8ms4x6"
         }
     },
     "tags": [
+        "preserve_original_event",
         "forwarded",
-        "preserve_original_event"
+        "okta-system"
     ],
     "user": {
         "full_name": "xxxxxx"

@@ -14,12 +14,11 @@ An example event for `system` looks as following:
 {
     "@timestamp": "2020-02-14T20:18:57.718Z",
     "agent": {
-        "ephemeral_id": "c8d18964-83d3-4be1-809c-201de8688e6b",
-        "hostname": "docker-fleet-agent",
-        "id": "62554406-4558-40ed-9cd2-c68d978882ff",
+        "ephemeral_id": "c8876910-3340-483c-b925-cde50a8e9810",
+        "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "7.13.0"
+        "version": "8.0.0-beta1"
     },
     "client": {
         "geo": {
@@ -43,23 +42,24 @@ An example event for `system` looks as following:
         "type": "logs"
     },
     "ecs": {
-        "version": "1.9.0"
+        "version": "8.0.0"
     },
     "elastic_agent": {
-        "id": "52c5ef7a-f604-488a-b39c-4ab431eb930e",
-        "snapshot": true,
-        "version": "7.13.0"
+        "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba",
+        "snapshot": false,
+        "version": "8.0.0-beta1"
     },
     "event": {
         "action": "user.session.start",
+        "agent_id_status": "verified",
         "category": [
             "authentication",
             "session"
         ],
-        "created": "2021-05-31T10:31:04.833Z",
+        "created": "2022-01-02T03:56:11.567Z",
         "dataset": "okta.system",
         "id": "3aeede38-4f67-11ea-abd3-1f5d113f2546",
-        "ingested": "2021-05-31T10:31:05.861084700Z",
+        "ingested": "2022-01-02T03:56:12Z",
         "kind": "event",
         "original": "{\"actor\":{\"alternateId\":\"xxxxxx@elastic.co\",\"detailEntry\":null,\"displayName\":\"xxxxxx\",\"id\":\"00u1abvz4pYqdM8ms4x6\",\"type\":\"User\"},\"authenticationContext\":{\"authenticationProvider\":null,\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":null,\"externalSessionId\":\"102bZDNFfWaQSyEZQuDgWt-uQ\",\"interface\":null,\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"108.255.197.247\",\"userAgent\":{\"browser\":\"FIREFOX\",\"os\":\"Mac OS X\",\"rawUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"deviceFingerprint\":\"541daf91d15bef64a7e08c946fd9a9d0\",\"requestId\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"requestUri\":\"/api/v1/authn\",\"threatSuspected\":\"false\",\"url\":\"/api/v1/authn?\"}},\"displayMessage\":\"User login to Okta\",\"eventType\":\"user.session.start\",\"legacyEventType\":\"core.user_auth.login_success\",\"outcome\":{\"reason\":null,\"result\":\"SUCCESS\"},\"published\":\"2020-02-14T20:18:57.718Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"ip\":\"108.255.197.247\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":null,\"asOrg\":null,\"domain\":null,\"isProxy\":null,\"isp\":null},\"severity\":\"INFO\",\"target\":null,\"transaction\":{\"detail\":{},\"id\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"type\":\"WEB\"},\"uuid\":\"3aeede38-4f67-11ea-abd3-1f5d113f2546\",\"version\":\"0\"}",
         "outcome": "success",
@@ -68,9 +68,6 @@ An example event for `system` looks as following:
             "user"
         ]
     },
-    "host": {
-        "name": "docker-fleet-agent"
-    },
     "input": {
         "type": "httpjson"
     },
@@ -124,33 +121,16 @@ An example event for `system` looks as following:
         ]
     },
     "source": {
-        "as": {
-            "number": 7018,
-            "organization": {
-                "name": "AT\u0026T Services, Inc."
-            }
-        },
-        "geo": {
-            "city_name": "Dublin",
-            "continent_name": "North America",
-            "country_iso_code": "US",
-            "country_name": "United States",
-            "location": {
-                "lat": 37.7201,
-                "lon": -121.919
-            },
-            "region_iso_code": "US-CA",
-            "region_name": "California"
-        },
         "ip": "108.255.197.247",
         "user": {
             "full_name": "xxxxxx",
             "id": "00u1abvz4pYqdM8ms4x6"
         }
     },
     "tags": [
+        "preserve_original_event",
         "forwarded",
-        "preserve_original_event"
+        "okta-system"
     ],
     "user": {
         "full_name": "xxxxxx"
@@ -178,7 +158,7 @@ An example event for `system` looks as following:
 | @timestamp | Event timestamp. | date |
 | client.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
 | client.as.organization.name | Organization name. | keyword |
-| client.domain | Client domain. | keyword |
+| client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword |
 | client.geo.city_name | City name. | keyword |
 | client.geo.country_name | Country name. | keyword |
 | client.geo.location | Longitude and latitude. | geo_point |
@@ -300,7 +280,7 @@ An example event for `system` looks as following:
 | related.user | All the user names or other user identifiers seen on the event. | keyword |
 | source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
 | source.as.organization.name | Organization name. | keyword |
-| source.domain | Source domain. | keyword |
+| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword |
 | source.geo.city_name | City name. | keyword |
 | source.geo.continent_name | Name of the continent. | keyword |
 | source.geo.country_iso_code | Country ISO code. | keyword |

@@ -1,14 +1,14 @@
 name: okta
 title: Okta Logs
-version: 1.3.2
+version: 1.4.0
 release: ga
 description: Collect and parse event logs from Okta API with Elastic Agent.
 type: integration
 format_version: 1.0.0
 license: basic
 categories: [security]
 conditions:
-  kibana.version: "^7.14.0 || ^8.0.0"
+  kibana.version: ^7.14.0 || ^8.0.0
 icons:
   - src: /img/okta-logo.svg
     title: Okta