Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Arista NG Firewall] Initial Release #6347

Merged
merged 23 commits into from
Jun 28, 2023
Merged

[Arista NG Firewall] Initial Release #6347

merged 23 commits into from
Jun 28, 2023

Conversation

MakoWish
Copy link
Contributor

@MakoWish MakoWish commented May 26, 2023 •
edited
Loading

Type of Change

  • Enhancement

What does this PR do?

This is an initial integration release for Arista NG Firewall (previously Untangle NG Firewall)

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • Package has been tested with sample data from all covered event types

Related issues

Additional Notes

I am not sure how to open elastic-package's stack up to accept live syslog data, so I am unable to create dashboards just yet. Once this initial release is available to install in my environment, I can get some dashboards created.

@MakoWish MakoWish force-pushed the arista_ng_firewall branch from ee4b3c1 to 8506103 Compare May 26, 2023 17:47
@elasticmachine
Copy link

elasticmachine commented May 26, 2023 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-06-22T21:50:17.513+0000

  • Duration: 14 min 29 sec

Test stats 🧪

Test Results
Failed 0
Passed 15
Skipped 0
Total 15

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@jamiehynds jamiehynds added the New Integration Issue or pull request for creating a new integration package. label May 29, 2023
efd6
efd6 reviewed Jun 5, 2023
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice. A few comments.

packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-common-config.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/http_event.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/web_filter.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/fields/base-fields.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/fields/ecs.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/manifest.yml Outdated Show resolved Hide resolved
@efd6
Copy link
Contributor

efd6 commented Jun 5, 2023

/test

@MakoWish MakoWish force-pushed the arista_ng_firewall branch from 38677ff to 2852c27 Compare June 5, 2023 16:24
@MakoWish MakoWish requested a review from a team as a code owner June 5, 2023 16:24
efd6
efd6 reviewed Jun 5, 2023
View reviewed changes
packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-common-config.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/web_filter.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/admin_login.yml Outdated Show resolved Hide resolved
packages/cisco_secure_endpoint/data_stream/event/fields/ecs.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/http_event.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/interface_stats.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/intrusion_prevention.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/system_stats.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved
@MakoWish MakoWish force-pushed the arista_ng_firewall branch from bed8621 to 9be8cfe Compare June 6, 2023 16:25
@MakoWish MakoWish force-pushed the arista_ng_firewall branch from 9be8cfe to 8b16fff Compare June 6, 2023 16:36
efd6
efd6 reviewed Jun 13, 2023
View reviewed changes
packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-common-config.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-unsupported-mesage-class.log Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/admin_login.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/http_event.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/system_stats.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/web_filter.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/fields/base-fields.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/manifest.yml Outdated Show resolved Hide resolved
packages/cisco_secure_endpoint/data_stream/event/fields/ecs.yml Outdated Show resolved Hide resolved
@efd6
Copy link
Contributor

efd6 commented Jun 13, 2023

/test

@efd6
Copy link
Contributor

efd6 commented Jun 13, 2023

You will need to add a line to https://github.com/elastic/integrations/blob/main/.github/CODEOWNERS

/packages/arista_ngfw @elastic/security-external-integrations

(list is — should be — ordered alphabetically)

@MakoWish
Copy link
Contributor Author

You will need to add a line to https://github.com/elastic/integrations/blob/main/.github/CODEOWNERS

/packages/arista_ngfw @elastic/security-external-integrations

(list is — should be — ordered alphabetically)

Beat you to it, but did not do alphabetically, because I noticed it was not already. I will move my addition into order.

@efd6
Copy link
Contributor

efd6 commented Jun 13, 2023

/test

@elasticmachine
Copy link

elasticmachine commented Jun 13, 2023 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (7/7) 💚
Classes 100.0% (7/7) 💚
Methods 100.0% (36/36) 💚
Lines 94.639% (865/914) 👍 8.103
Conditionals 100.0% (0/0) 💚

efd6
efd6 reviewed Jun 14, 2023
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM after cisco file is removed.

@MakoWish
Copy link
Contributor Author

LGTM after cisco file is removed.

I reverted the changes, but how do I remove it?

@efd6
Copy link
Contributor

efd6 commented Jun 14, 2023

Done. I just did a revert of the changes on that file an pushed it (you could copy from the main branch's state, but I did a file revert on that file for each of the commits here that touched it).

@efd6
Copy link
Contributor

efd6 commented Jun 14, 2023

/test

@elasticmachine
Copy link

💔 Build Failed

Failed CI Steps

History

@MakoWish
Copy link
Contributor Author

@efd6,

Is there a way to install this onto a live Elastic cluster instead of just the elastic-package stack?

efd6
efd6 reviewed Jun 19, 2023
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM after minor issues addressed.

packages/arista_ngfw/_dev/build/build.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/admin_login.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/http_event.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/interface_stats.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/intrusion_prevention.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/system_stats.yml Outdated Show resolved Hide resolved
packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/web_filter.yml Outdated Show resolved Hide resolved
MakoWish and others added 9 commits June 19, 2023 16:56
@MakoWish @efd6
Commit suggested change from code review
3d1aed3 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish @efd6
Commit suggested change from code review
cde3dd0 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish @efd6
Commit suggested change from code review
a11cabe 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish @efd6
Commit suggested change from code review
9ba34e3 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish @efd6
Commit suggested change from code review
08b367e 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish @efd6
Commit suggested change from code review
cab5250 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish @efd6
Commit suggested change from code review
468a234 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish @efd6
Commit suggested change from code review
11abda4 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish @efd6
Commit suggested change from code review
2fb9ae9 
Co-authored-by: Dan Kortschak <[email protected]>
@MakoWish
Copy link
Contributor Author

Anything else needed on this one? Also, is there a way to install onto a test cluster so I can push some live data to it? Or do I need to wait until the Beta is actually released?

@efd6
Copy link
Contributor

efd6 commented Jun 21, 2023

Easiest to wait until it's released.

efd6
efd6 approved these changes Jun 21, 2023
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@efd6
Copy link
Contributor

efd6 commented Jun 21, 2023

/test

@MakoWish
Copy link
Contributor Author

It failed because the expected results did not match after the ECS version change. Regenerated the expected results, and the test passes locally now. Please test again.

@efd6
Copy link
Contributor

efd6 commented Jun 22, 2023

/test

@MakoWish
Copy link
Contributor Author

I'm getting a 404 when trying to view the BuildKite results again. It worked for a few days, but not anymore.

Anything else needed on this?

@efd6
Copy link
Contributor

efd6 commented Jun 28, 2023

Don't worry about the buildkite builds, they are not required at this stage.

efd6
efd6 approved these changes Jun 28, 2023
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still LGTM

@efd6 efd6 merged commit e1c65f6 into elastic:main Jun 28, 2023
@efd6
Copy link
Contributor

efd6 commented Jun 28, 2023

Thanks

@elasticmachine
Copy link

Package arista_ngfw - 0.0.1 containing this change is available at https://epr.elastic.co/search?package=arista_ngfw

@MakoWish MakoWish deleted the arista_ng_firewall branch June 28, 2023 14:33
@andrewkroh andrewkroh added the Integration:arista_ngfw Arista NG Firewall label Jul 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@efd6 efd6 efd6 approved these changes

Assignees
No one assigned
Labels
Integration:arista_ngfw Arista NG Firewall New Integration Issue or pull request for creating a new integration package.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Arista NG Firewall] Initial Release
5 participants
@MakoWish @elasticmachine @efd6 @andrewkroh @jamiehynds