Skip to content

Commit

Permalink
[O365] updating o365 ECS version and adding event.original options (e…
Browse files Browse the repository at this point in the history 
…lastic#1117)

* updating o365 ECS version and adding event.original options

* add changelog and linting

* update config
  • Loading branch information
@P1llus
P1llus authored Jun 11, 2021
1 parent d53f2a9 commit 109b711
Show file tree
Hide file tree
Showing 34 changed files with 2,235 additions and 867 deletions.
5 changes: 5 additions & 0 deletions packages/o365/changelog.yml
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "0.5.0"
changes:
- description: update to ECS 1.10.0 and adding event.original options
type: enhancement
link: https://github.com/elastic/integrations/pull/1117
- version: "0.4.0"
changes:
- description: moving edge processing to ingest pipelines
Expand Down
552 changes: 414 additions & 138 deletions packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-sts-logon.log-expected.json
View file

Large diffs are not rendered by default.

7 changes: 0 additions & 7 deletions packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread.log-config.yml
View file

This file was deleted.

800 changes: 600 additions & 200 deletions packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread.log-expected.json
View file

Large diffs are not rendered by default.

2 changes: 2 additions & 0 deletions ...ine/test-azuread-sts-logon.log-config.yml → ..._dev/test/pipeline/test-common-config.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,5 @@ fields:
"_conf":
"tenants":
"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd": "mytenant.onmicrosoft.com"
tags:
- preserve_original_event
7 changes: 0 additions & 7 deletions packages/o365/data_stream/audit/_dev/test/pipeline/test-data-insights-api.log-config.yml
View file

This file was deleted.

90 changes: 63 additions & 27 deletions packages/o365/data_stream/audit/_dev/test/pipeline/test-data-insights-api.log-expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
},
"@timestamp": "2020-02-10T15:13:38.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -25,7 +25,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636536Z",
"ingested": "2021-06-09T12:50:17.935344100Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"DataType\": \"DataInsightsSubscription\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"CreationTime\": \"2020-02-10T15:13:38\", \"UserId\": \"Service Account\", \"UserType\": 5, \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"20a7bbcf-8e64-4e60-b075-08d7ae3bcea0\", \"RecordType\": 52}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -41,7 +42,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
},
{
"o365": {
Expand All @@ -57,7 +61,7 @@
},
"@timestamp": "2020-02-12T21:38:38.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -68,7 +72,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636583900Z",
"ingested": "2021-06-09T12:50:17.935358800Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"DataType\": \"DataInsightsSubscription\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"CreationTime\": \"2020-02-12T21:38:38\", \"UserId\": \"Service Account\", \"UserType\": 5, \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"0ff67168-de8c-45fb-3f7d-08d7b003ebdc\", \"RecordType\": 52}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -84,7 +89,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
},
{
"o365": {
Expand All @@ -100,7 +108,7 @@
},
"@timestamp": "2020-02-10T15:13:38.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -111,7 +119,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636590700Z",
"ingested": "2021-06-09T12:50:17.935362500Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"RecordType\": 52, \"DataType\": \"DataInsightsSubscription\", \"CreationTime\": \"2020-02-10T15:13:38\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"UserId\": \"Service Account\", \"UserType\": 5, \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"20a7bbcf-8e64-4e60-b075-08d7ae3bcea0\"}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -127,7 +136,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
},
{
"o365": {
Expand All @@ -143,7 +155,7 @@
},
"@timestamp": "2020-02-12T10:53:26.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -154,7 +166,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636594700Z",
"ingested": "2021-06-09T12:50:17.935365700Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"RecordType\": 52, \"DataType\": \"DataInsightsSubscription\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"CreationTime\": \"2020-02-12T10:53:26\", \"UserId\": \"Service Account\", \"UserType\": 5, \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"3b492d08-23a8-4e65-75ea-08d7afa9c9a2\"}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -170,7 +183,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
},
{
"o365": {
Expand All @@ -186,7 +202,7 @@
},
"@timestamp": "2020-02-12T21:38:38.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -197,7 +213,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636598Z",
"ingested": "2021-06-09T12:50:17.935368300Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"RecordType\": 52, \"DataType\": \"DataInsightsSubscription\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"CreationTime\": \"2020-02-12T21:38:38\", \"UserId\": \"Service Account\", \"UserType\": 5, \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"0ff67168-de8c-45fb-3f7d-08d7b003ebdc\"}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -213,7 +230,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
},
{
"o365": {
Expand All @@ -229,7 +249,7 @@
},
"@timestamp": "2020-02-12T10:53:26.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -240,7 +260,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636601300Z",
"ingested": "2021-06-09T12:50:17.935370900Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"RecordType\": 52, \"UserType\": 5, \"DataType\": \"DataInsightsSubscription\", \"CreationTime\": \"2020-02-12T10:53:26\", \"UserId\": \"Service Account\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"3b492d08-23a8-4e65-75ea-08d7afa9c9a2\"}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -256,7 +277,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
},
{
"o365": {
Expand All @@ -272,7 +296,7 @@
},
"@timestamp": "2020-02-10T15:13:38.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -283,7 +307,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636604300Z",
"ingested": "2021-06-09T12:50:17.935373400Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"RecordType\": 52, \"UserType\": 5, \"DataType\": \"DataInsightsSubscription\", \"UserId\": \"Service Account\", \"CreationTime\": \"2020-02-10T15:13:38\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"20a7bbcf-8e64-4e60-b075-08d7ae3bcea0\"}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -299,7 +324,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
},
{
"o365": {
Expand All @@ -315,7 +343,7 @@
},
"@timestamp": "2020-02-12T10:53:26.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -326,7 +354,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636607400Z",
"ingested": "2021-06-09T12:50:17.935376100Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"RecordType\": 52, \"UserType\": 5, \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"CreationTime\": \"2020-02-12T10:53:26\", \"UserId\": \"Service Account\", \"DataType\": \"DataInsightsSubscription\", \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"3b492d08-23a8-4e65-75ea-08d7afa9c9a2\"}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -342,7 +371,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
},
{
"o365": {
Expand All @@ -358,7 +390,7 @@
},
"@timestamp": "2020-02-12T21:38:38.000Z",
"ecs": {
"version": "1.9.0"
"version": "1.10.0"
},
"organization": {
"name": "mytenant.onmicrosoft.com",
Expand All @@ -369,7 +401,8 @@
"id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
},
"event": {
"ingested": "2021-06-02T06:59:52.636610400Z",
"ingested": "2021-06-09T12:50:17.935378700Z",
"original": "{\"Workload\": \"SecurityComplianceCenter\", \"RecordType\": 52, \"UserType\": 5, \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"UserId\": \"Service Account\", \"CreationTime\": \"2020-02-12T21:38:38\", \"DataType\": \"DataInsightsSubscription\", \"Version\": 1, \"UserKey\": \"Service Account\", \"Operation\": \"SearchDataInsightsSubscription\", \"Id\": \"0ff67168-de8c-45fb-3f7d-08d7b003ebdc\"}",
"code": "DataInsightsRestApiAudit",
"provider": "SecurityComplianceCenter",
"kind": "event",
Expand All @@ -385,7 +418,10 @@
},
"user": {
"id": "Service Account"
}
},
"tags": [
"preserve_original_event"
]
}
]
}
7 changes: 0 additions & 7 deletions packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-exchange.log-config.yml
View file

This file was deleted.

Loading

0 comments on commit 109b711

Please sign in to comment.