[Cisco FTD] Convert source.bytes and network.bytes to integer for proper calculation of network.bytes #5859

MakoWish · 2023-04-11T15:30:32Z

Type of change

Bug

What does this PR do?

The values of source.bytes and network.bytes may enter the pipeline as string values instead of integers. This is causing the combination of strings instead of addition of integers in the calculation of network.bytes. This PR adds two convert processors immediately before the network.bytes calculation to ensure both source.bytes and destination.bytes are integers.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

Tested Ingest Pipeline modifications locally

Related issues

Closes [Cisco FTD] Miscalculation of network.bytes due to String Values Instead of Integers #5858

…ion of network.bytes [5858]

elasticmachine · 2023-04-11T15:33:53Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-04-18T22:13:55.125+0000
Duration: 18 min 18 sec

Test stats 🧪

Test	Results
Failed	0
Passed	20
Skipped	0
Total	20

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

elasticmachine · 2023-04-12T19:08:58Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

efd6 · 2023-04-16T23:37:26Z

/test

efd6

This looks fine, but it would be great to add a pipeline test to keep us honest.

packages/cisco_ftd/changelog.yml

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

MakoWish · 2023-04-17T17:17:11Z

This looks fine, but it would be great to add a pipeline test to keep us honest.

You just need some sanitized sample events?

efd6 · 2023-04-17T21:44:33Z

If you're unable to add the tests yourself, then yes, that's what's needed.

efd6 · 2023-04-17T21:45:05Z

/test

elasticmachine · 2023-04-17T22:03:15Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`1/1`)	💚
Files	100.0% (`1/1`)	💚
Classes	100.0% (`1/1`)	💚
Methods	100.0% (`19/19`)	💚
Lines	67.996% (`1296/1906`)	👎 -27.188
Conditionals	100.0% (`0/0`)	💚

efd6 · 2023-04-17T22:33:18Z

It looks like the tests already in place cover this. Are you able to regenerate the expectations?

MakoWish · 2023-04-17T22:41:07Z

Here are a few:

<143>2023-04-17T22:22:39Z FW-BLDG1-1  %FTD-7-430002: EventPriority: Low, DeviceUUID: f25f0cae-520d-11ec-b5f5-0000000000ee, InstanceID: 1, FirstPacketSecond: 2023-04-17T22:22:39Z, ConnectionID: 12345, AccessControlRuleAction: Block, SrcIP: 192.168.1.97, DstIP: 8.8.8.8, SrcPort: 56627, DstPort: 443, Protocol: tcp, IngressInterface: IF-Inside, EgressInterface: IF-Outside, IngressZone: internal, EgressZone: external, IngressVRF: Global, EgressVRF: Global, ACPolicy: FTD-A-POL-1, AccessControlRuleName: Default Action, Prefilter Policy: Default Prefilter Policy, User: CONTOSO\jdoe, Client: Chrome, ClientVersion: 111.0.0.0, ApplicationProtocol: HTTP, WebApplication: Skype, InitiatorPackets: 9, ResponderPackets: 14, InitiatorBytes: 1525, ResponderBytes: 6761, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: Contoso_SSL_Policy, SSLRuleName: decrypt_all, SSLFlowStatus: Success, SSLCipherSuite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, SSLCertificate: 5d98effdf71809xxxxxxxxxxxxxxxxd7851af965, SSLVersion: TLSv1.2, SSLServerCertStatus: Valid, SSLActualAction: Decrypt (Resign), SSLExpectedAction: Decrypt (Resign), SSLURLCategory: Computers and Internet, SSLSessionID: 191a2f9df1607775002c35a38c0a27e3d286f2e201a7xxxxxxxxxxxxxxxxxxxx, URLCategory: Computers and Internet, URLReputation: Favorable
Apr 17 2023 22:22:39 FW-BLDG6-1  %FTD-6-430002: EventPriority: Low, DeviceUUID: f25f0cae-520d-11ec-b5f5-2222222222dd, InstanceID: 7, FirstPacketSecond: 2023-04-17T22:22:39Z, ConnectionID: 34567, AccessControlRuleAction: Allow, SrcIP: 192.168.120.30, DstIP: 8.8.4.4, SrcPort: 64326, DstPort: 443, Protocol: tcp, IngressInterface: IF-Inside, EgressInterface: IF-Outside, IngressZone: internal, EgressZone: external, IngressVRF: Global, EgressVRF: Global, ACPolicy: POL-1, AccessControlRuleName: ALL ALLOWED Non-Group, Prefilter Policy: Default Prefilter Policy, User: CONTOSO\foobar, Client: Cisco Secure Endpoint, ApplicationProtocol: HTTPS, InitiatorPackets: 3, ResponderPackets: 1, InitiatorBytes: 381, ResponderBytes: 66, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: AppliedMedical_SSL_Policy, SSLRuleName: am_rsm_servers_exempt, SSLFlowStatus: Success, SSLCipherSuite: Unknown, SSLCertificate: 88954f2521013d1c180baaaaaaaaaaaaaaaaaaaa, SSLVersion: Unknown, SSLServerCertStatus: Valid, SSLActualAction: Do Not Decrypt, SSLExpectedAction: Do Not Decrypt, URLCategory: Computers and Internet, URLReputation: Trusted, URL: https://tetra-defs.amp.cisco.com
<143>2023-04-17T22:22:39Z   %FTD-7-430003: AccessControlRuleAction: Allow, SrcIP: 192.168.100.32, DstIP: 8.8.4.4, SrcPort: 48100, DstPort: 443, Protocol: tcp, IngressInterface: IF-Inside, EgressInterface: IF-Outside, IngressZone: Inside, EgressZone: Outside, ACPolicy: Base_Policy, AccessControlRuleName: All Allowed, Prefilter Policy: Default Prefilter Policy, User: Unknown, Client: SSL client, ApplicationProtocol: HTTPS, WebApplication: Google APIs, ConnectionDuration: 90, InitiatorPackets: 0, ResponderPackets: 0, InitiatorBytes: 638, ResponderBytes: 4950, NAPPolicy: Balanced Security and Connectivity, URLCategory: Computer and Internet Info, URLReputation: Well known, URL: https://storage.googleapis.com
<119>2023-04-17T22:22:39Z FW-BLDG2-2  %FTD-7-430003: EventPriority: Low, DeviceUUID: 01dca86e-d979-11e8-83ae-abcdefghif12, InstanceID: 2, FirstPacketSecond: 2023-04-17T22:22:33Z, ConnectionID: 45678, AccessControlRuleAction: Allow, SrcIP: 192.168.30.40, DstIP: 1.1.2.2, SrcPort: 51544, DstPort: 443, Protocol: tcp, IngressInterface: IF-Inside, EgressInterface: IF-Outside, IngressZone: inside, EgressZone: outside, IngressVRF: Global, EgressVRF: Global, ACPolicy: Base_Policy, AccessControlRuleName: Whitelisted_Access_Websites, Prefilter Policy: Default Prefilter Policy, User: Not Found, Client: SSL client, ApplicationProtocol: HTTPS, WebApplication: Sharepoint Online, ConnectionDuration: 6, InitiatorPackets: 13, ResponderPackets: 18, InitiatorBytes: 4016, ResponderBytes: 13048, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: None, SSLFlowStatus: Success, SSLCipherSuite: Unknown, SSLCertificate: ff6ca78ac51c0582b77fbbbbbbbbbbbbbbbbbbbb, SSLVersion: Unknown, SSLServerCertStatus: Valid, SSLActualAction: Do Not Decrypt, SSLExpectedAction: Do Not Decrypt, URL: https://contoso.sharepoint.com

Eric

MakoWish · 2023-04-17T22:42:05Z

Was adding the above sample messages while you responded. How exactly would I regenerate expectations? The expectation is that 1+1=2 instead of 1+1=11.

efd6 · 2023-04-17T22:54:57Z

This requires that you have the elastic-package dev tools and Docker installed. Then you run elastic-package test pipeline -g in the package directory. If you can't do this, let me know and I'll add the required changes.

MakoWish · 2023-04-18T15:20:14Z

If you wouldn't mind. I will work on getting that setup in the meantime for any future needs.

Eric

efd6 · 2023-04-18T22:13:42Z

/test

efd6

thanks

elasticmachine · 2023-04-18T23:01:19Z

Package cisco_ftd - 2.10.1 containing this change is available at https://epr.elastic.co/search?package=cisco_ftd

…calculation of network.bytes (elastic#5859)

Convert source.bytes and network.bytes to integer for proper calculat…

c2cd7c5

…ion of network.bytes [5858]

MakoWish requested a review from a team as a code owner April 11, 2023 15:30

MakoWish added 2 commits April 11, 2023 09:32

Update changelog.yml

6290182

Increment version number

6c2b903

jamiehynds added the Team:Security-External Integrations label Apr 12, 2023

jamiehynds added the Integration:CiscoFTD Cisco FTD Firepower Threat Defense label Apr 12, 2023

efd6 reviewed Apr 16, 2023

View reviewed changes

efd6 reviewed Apr 17, 2023

View reviewed changes

packages/cisco_ftd/changelog.yml Show resolved Hide resolved

Update packages/cisco_ftd/changelog.yml

281bb46

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

generate test expectations

48b7d77

efd6 approved these changes Apr 18, 2023

View reviewed changes

efd6 merged commit c05ea1c into elastic:main Apr 18, 2023
1 check passed

MakoWish deleted the cisco_ftd_network_bytes branch April 18, 2023 23:01

bhapas pushed a commit to bhapas/integrations that referenced this pull request Apr 19, 2023

[Cisco FTD] Convert {source,destination}.bytes to integer for proper …

a925ea0

…calculation of network.bytes (elastic#5859)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cisco FTD] Convert source.bytes and network.bytes to integer for proper calculation of network.bytes #5859

[Cisco FTD] Convert source.bytes and network.bytes to integer for proper calculation of network.bytes #5859

MakoWish commented Apr 11, 2023 •

edited

Loading

elasticmachine commented Apr 11, 2023 •

edited

Loading

Build stats

Test stats 🧪

elasticmachine commented Apr 12, 2023

efd6 commented Apr 16, 2023

efd6 left a comment

MakoWish commented Apr 17, 2023

efd6 commented Apr 17, 2023

efd6 commented Apr 17, 2023

elasticmachine commented Apr 17, 2023 •

edited

Loading

efd6 commented Apr 17, 2023

MakoWish commented Apr 17, 2023

MakoWish commented Apr 17, 2023 •

edited

Loading

efd6 commented Apr 17, 2023

MakoWish commented Apr 18, 2023

efd6 commented Apr 18, 2023

efd6 left a comment

elasticmachine commented Apr 18, 2023

[Cisco FTD] Convert source.bytes and network.bytes to integer for proper calculation of network.bytes #5859

[Cisco FTD] Convert source.bytes and network.bytes to integer for proper calculation of network.bytes #5859

Conversation

MakoWish commented Apr 11, 2023 • edited Loading

Type of change

What does this PR do?

Checklist

Author's Checklist

Related issues

elasticmachine commented Apr 11, 2023 • edited Loading

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

elasticmachine commented Apr 12, 2023

efd6 commented Apr 16, 2023

efd6 left a comment

Choose a reason for hiding this comment

MakoWish commented Apr 17, 2023

efd6 commented Apr 17, 2023

efd6 commented Apr 17, 2023

elasticmachine commented Apr 17, 2023 • edited Loading

🌐 Coverage report

efd6 commented Apr 17, 2023

MakoWish commented Apr 17, 2023

MakoWish commented Apr 17, 2023 • edited Loading

efd6 commented Apr 17, 2023

MakoWish commented Apr 18, 2023

efd6 commented Apr 18, 2023

efd6 left a comment

Choose a reason for hiding this comment

elasticmachine commented Apr 18, 2023

MakoWish commented Apr 11, 2023 •

edited

Loading

elasticmachine commented Apr 11, 2023 •

edited

Loading

elasticmachine commented Apr 17, 2023 •

edited

Loading

MakoWish commented Apr 17, 2023 •

edited

Loading