adding zerofox integration

[zf-jedmunds]

Enhancement

Integration to the ZeroFOX alerts API

Screenshots

[cla-checker-service]

💚 CLA has been signed

[zf-jedmunds]

@marc-gr - i just signed the contributor agreement

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-07-29T14:25:47.985+0000

• Duration: 12 min 36 sec

• Commit: 7b1a7b5

Test stats 🧪

Test	Results
Failed	0
Passed	3
Skipped	0
Total	3

Trends 🧪

[marc-gr]

It is looking good! 🎉

Some of the fields under zerofox that could be mapped to ECS fields, and maybe would be nice to have some extra test logs to see some of the empty fields in use. LMK if you need any help to move forward.

[marc-gr]

hey @zf-jedmunds ! Thanks for the changes.

One thing I noticed in your pipeline is that the majority of it is dedicated to renaming fields from json to zerofox. I think it could be rewritten to simplify it by doing the renaming at an early stage. I rewrote it taking this into account and adding some bits at the end to get rid of empty arrays and strings that were being generated.

---
description: Pipeline for parsing zerofox alerts
processors:
  - set:
      field: event.ingested
      value: '{{_ingest.timestamp}}'

  - set:
      field: ecs.version
      value: 1.9.0

  - rename:
      field: message
      target_field: event.original

  - json:
      field: event.original
      target_field: zerofox

  - set:
      field: zerofox.severity
      value: info
      if: ctx?.zerofox?.severity == 1
  - set:
      field: zerofox.severity
      value: low
      if: ctx?.zerofox?.severity == 2
  - set:
      field: zerofox.severity
      value: medium
      if: ctx?.zerofox?.severity == 3
  - set:
      field: zerofox.severity
      value: high
      if: ctx?.zerofox?.severity == 4
  - set:
      field: zerofox.severity
      value: critical
      if: ctx?.zerofox?.severity == 5

  - convert:
      field: zerofox.id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.asset_term.id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.entity.id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.entity.entity_group.id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.entity_term.id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.perpetrator.id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.rule_id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.rule_group_id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.asset.id
      type: string
      ignore_missing: true
      ignore_failure: true

  - convert:
      field: zerofox.asset.entity_group.id
      type: string
      ignore_missing: true
      ignore_failure: true

  - json:
      field: zerofox.metadata
      ignore_failure: true

 ## Cleanup.

  - remove:
      field:
        - zerofox.logs
        - zerofox.entered_by
        - zerofox.asset_term
        - zerofox.entity_term
        - zerofox.business_network
        - zerofox.entity_email_receiver_id
      ignore_missing: true
      ignore_failure: true
  - script:
      description: Remove all empty values from zerofox.perpetrator.
      lang: painless
      if: ctx?.zerofox?.perpetrator != null
      source: ctx.zerofox.perpetrator?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals("") || (entry.getValue() instanceof List && entry.getValue().length == 0) || (entry.getValue() instanceof Map && entry.getValue().size() == 0));
  - script:
      description: Remove all empty values from zerofox.metadata.
      lang: painless
      if: ctx?.zerofox?.metadata != null
      source: ctx?.zerofox?.metadata?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals("") || (entry.getValue() instanceof List && entry.getValue().length == 0) || (entry.getValue() instanceof Map && entry.getValue().size() == 0));
  - script:
      description: Remove all empty values from zerofox.
      lang: painless
      if: ctx?.zerofox != null
      source: ctx?.zerofox?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals("") || (entry.getValue() instanceof List && entry.getValue().length == 0) || (entry.getValue() instanceof Map && entry.getValue().size() == 0));

on_failure:
  - set:
      field: error.message
      value: "{{ _ingest.on_failure_message }}"

Please take a look and feel free to change anything you need in case I messed it up :) If you end up using it remember to re-generate the test golden files.

On top of that, would be nice if some ECS mappings could be done and just keep under the zerofox.* namespace anything that is not possible to map to ECS fields. LMK if you need anything from our side to move forward :)

Thanks for the work!

[marc-gr]

/test

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[marc-gr]

/test

[marc-gr]

/test