[Prisma Cloud] Initial Release for Prisma Cloud #8135

mohitjha-elastic · 2023-10-09T10:50:09Z

What does this PR do?

Generated the skeleton of the Prisma Cloud integration package.
Added data stream.
Added data collection logic for the data stream.
Added the ingest pipeline for the data stream.
Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files.
Added test for pipeline for the data stream.

Integration release checklist

This checklist is intended for integrations maintainers to ensure consistency when creating or updating a Package, Module or Dataset for an Integration.

All changes

Change follows the contributing guidelines
Supported versions of the monitoring target is documented
Supported operating systems are documented (if applicable)
Integration or System tests exist
Documentation exists
Fields follow ECS and naming conventions
At least a manual test with ES / Kibana / Agent has been performed.
Required Kibana version set to: ^8.8.0

New Package

Screenshot of the "Add Integration" page on Fleet added

Log dataset changes

Pipeline tests exist (if applicable)
Generated output for at least 1 log file exists
Sample event (sample_event.json) exists

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/prisma_cloud directory.
Run the following command to run tests.

elastic-package test

Related issues

Closes Palo Alto Prisma Cloud #1132

Automated Test

test-file.txt

Screenshot

We are facing message size exceeding errors so need to validate it in the cloud instance.

…prisma_cloud-0.1.0

elasticmachine · 2023-10-09T10:53:33Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-10-23T07:40:17.362+0000
Duration: 25 min 25 sec

Test stats 🧪

Test	Results
Failed	0
Passed	30
Skipped	0
Total	30

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

P1llus · 2023-10-09T11:33:30Z

/test

elasticmachine · 2023-10-09T13:03:21Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

kcreddy · 2023-10-10T09:40:13Z

/test

elasticmachine · 2023-10-10T10:01:44Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`5/5`)	💚
Files	100.0% (`5/5`)	💚
Classes	100.0% (`5/5`)	💚
Methods	94.118% (`64/68`)	👎 -2.132
Lines	94.914% (`7017/7393`)	👎 -5.086
Conditionals	100.0% (`0/0`)	💚

kcreddy · 2023-10-10T09:43:52Z

packages/prisma_cloud/_dev/build/build.yml

@@ -0,0 +1,4 @@
+dependencies:
+  ecs:
+    reference: git@v8.9.0


Suggested change

reference: git@v8.9.0

reference: git@v8.10.0

kcreddy · 2023-10-10T09:51:07Z

packages/prisma_cloud/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

+  - set:
+      field: ecs.version
+      tag: set_ecs_version
+      value: 8.9.0


8.10.0 is now available.

packages/prisma_cloud/data_stream/audit/agent/stream/input.yml.hbs

kcreddy · 2023-10-10T10:16:12Z

packages/prisma_cloud/data_stream/alert/_dev/test/system/test-input-config.yml

+  vars:
+    url: http://{{Hostname}}:{{Port}}
+    preserve_original_event: true
+    preserve_duplicate_custom_fields: true


Can you add assert.hit_count to all system test configs?

piyush-elastic · 2023-10-10T12:56:52Z

packages/prisma_cloud/manifest.yml

@@ -0,0 +1,113 @@
+format_version: 2.8.0
+name: prisma_cloud
+title: "Prisma Cloud"


update title to Palo Alto Prisma Cloud

kcreddy · 2023-10-13T12:24:47Z

/test

kcreddy · 2023-10-13T13:05:06Z

packages/prisma_cloud/data_stream/host/_dev/test/system/test-input-config.yml

+    preserve_original_event: true
+    preserve_duplicate_custom_fields: true
+assert:
+  hit_count: 500


How are we getting 500 events? Where are these 500 events defined?

leandrojmp · 2023-10-20T18:28:54Z

Hello, just curious, is this integration planned for 8.10 or just 8.11?

mohitjha-elastic · 2023-10-23T06:09:19Z

Hello, just curious, is this integration planned for 8.10 or just 8.11?

Hey @leandrojmp, We have planned it for 8.10.1.

…host profile data streams.

kcreddy

LGTM

kcreddy · 2023-10-23T08:16:30Z

packages/prisma_cloud/data_stream/host/agent/stream/input.yml.hbs

            "user": state.user,
            "password": state.password,
            "batch_size": string(state.batch_size),
+            "access_token": state.access_token,


you could save this token in redact config next release

elasticmachine · 2023-10-23T08:56:17Z

Package prisma_cloud - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=prisma_cloud

leandrojmp · 2023-10-24T16:09:40Z

Hello,

We are planning to test this integration, but one question, is the Incident Audit dataset only available when using TCP/UDP? The datastreams for this dataset only have those two inputs available.

Not sure if this is a limitation of the Prisma Cloud tool or the integration.

EDIT:

Just saw this in the notes:

Currently, we are unable to collect logs of Incident Audit datastream via defined API. Hence, we have not added the configuration of Incident Audit data stream via REST API.

mohitjha-elastic added 2 commits October 9, 2023 13:08

Initial Release for Prisma Cloud

da632ea

Merge branch 'main' of github.com:mohitjha-elastic/integrations into …

b69547d

…prisma_cloud-0.1.0

Update the changelog entry

6deb450

jamiehynds mentioned this pull request Oct 9, 2023

Palo Alto Prisma Cloud #1132

Closed

15 tasks

Changed kibana version in manifest

9ede4ef

jamiehynds requested a review from a team October 9, 2023 13:03

jamiehynds added the Team:Security-External Integrations label Oct 9, 2023

jamiehynds added the New Integration label Oct 9, 2023

kcreddy reviewed Oct 10, 2023

View reviewed changes

piyush-elastic reviewed Oct 10, 2023

View reviewed changes

Resolve review comments

9af0b77

mohitjha-elastic requested a review from kcreddy October 13, 2023 10:46

piyush-elastic approved these changes Oct 13, 2023

View reviewed changes

kcreddy reviewed Oct 13, 2023

View reviewed changes

Update kibana version to 8.10.1. Change in cursor logic for host and …

489e2cf

…host profile data streams.

mohitjha-elastic requested a review from kcreddy October 23, 2023 07:40

kcreddy approved these changes Oct 23, 2023

View reviewed changes

kcreddy merged commit f6cc2d1 into elastic:main Oct 23, 2023
3 checks passed

mohitjha-elastic deleted the prisma_cloud-0.1.0 branch October 25, 2023 07:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Prisma Cloud] Initial Release for Prisma Cloud #8135

[Prisma Cloud] Initial Release for Prisma Cloud #8135

mohitjha-elastic commented Oct 9, 2023 •

edited

Loading

elasticmachine commented Oct 9, 2023 •

edited

Loading

Build stats

Test stats 🧪

P1llus commented Oct 9, 2023

elasticmachine commented Oct 9, 2023

kcreddy commented Oct 10, 2023

elasticmachine commented Oct 10, 2023 •

edited

Loading

kcreddy Oct 10, 2023

kcreddy Oct 10, 2023

kcreddy Oct 10, 2023

piyush-elastic Oct 10, 2023

kcreddy commented Oct 13, 2023

kcreddy Oct 13, 2023

leandrojmp commented Oct 20, 2023

mohitjha-elastic commented Oct 23, 2023

kcreddy left a comment

kcreddy Oct 23, 2023 •

edited

Loading

elasticmachine commented Oct 23, 2023

leandrojmp commented Oct 24, 2023 •

edited

Loading

[Prisma Cloud] Initial Release for Prisma Cloud #8135

[Prisma Cloud] Initial Release for Prisma Cloud #8135

Conversation

mohitjha-elastic commented Oct 9, 2023 • edited Loading

What does this PR do?

Integration release checklist

All changes

New Package

Log dataset changes

How to test this PR locally

Related issues

Automated Test

Screenshot

elasticmachine commented Oct 9, 2023 • edited Loading

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

P1llus commented Oct 9, 2023

elasticmachine commented Oct 9, 2023

kcreddy commented Oct 10, 2023

elasticmachine commented Oct 10, 2023 • edited Loading

🌐 Coverage report

kcreddy Oct 10, 2023

Choose a reason for hiding this comment

kcreddy Oct 10, 2023

Choose a reason for hiding this comment

kcreddy Oct 10, 2023

Choose a reason for hiding this comment

piyush-elastic Oct 10, 2023

Choose a reason for hiding this comment

kcreddy commented Oct 13, 2023

kcreddy Oct 13, 2023

Choose a reason for hiding this comment

leandrojmp commented Oct 20, 2023

mohitjha-elastic commented Oct 23, 2023

kcreddy left a comment

Choose a reason for hiding this comment

kcreddy Oct 23, 2023 • edited Loading

Choose a reason for hiding this comment

elasticmachine commented Oct 23, 2023

leandrojmp commented Oct 24, 2023 • edited Loading

mohitjha-elastic commented Oct 9, 2023 •

edited

Loading

elasticmachine commented Oct 9, 2023 •

edited

Loading

elasticmachine commented Oct 10, 2023 •

edited

Loading

kcreddy Oct 23, 2023 •

edited

Loading

leandrojmp commented Oct 24, 2023 •

edited

Loading