Skip to content

Commit 73c4b85

Browse files
YANG-DBYANG-DB
committed
new ocsf siem security integrations
Signed-off-by: YANGDB <[email protected]>
1 parent d4eaec0 commit 73c4b85

File tree

52 files changed

+1858
-8
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+1858
-8
lines changed

Diff for: ‎server/adaptors/integrations/__data__/repository/amazon_cloudfront/amazon_cloudfront-1.0.0.json

+210-8
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,13 @@
55
"description": "Analyze access logs for Amazon CloudFront.",
66
"license": "Apache-2.0",
77
"type": "logs-aws_cloudfront",
8-
"labels": ["Observability", "Logs", "AWS", "Cloud", "Flint S3"],
8+
"labels": [
9+
"Observability",
10+
"Logs",
11+
"AWS",
12+
"Cloud",
13+
"Flint S3"
14+
],
915
"author": "OpenSearch",
1016
"sourceUrl": "https://github.com/opensearch-project/dashboards-observability/tree/main/server/adaptors/integrations/__data__/repository/aws_cloudfront/info",
1117
"statics": {
@@ -35,20 +41,208 @@
3541
}
3642
],
3743
"components": [
44+
{
45+
"name": "aws_config",
46+
"version": "1.0.0"
47+
},
48+
{
49+
"name": "aws_clientvpn",
50+
"version": "1.0.0"
51+
},
3852
{
3953
"name": "aws_cloudfront",
4054
"version": "1.0.0"
4155
},
4256
{
43-
"name": "aws_s3",
57+
"name": "aws_cloudhsm",
58+
"version": "1.0.0"
59+
},
60+
{
61+
"name": "aws_cloudtrail",
62+
"version": "1.0.0"
63+
},
64+
{
65+
"name": "aws_elasticache",
66+
"version": "1.0.0"
67+
},
68+
{
69+
"name": "aws_elb",
70+
"version": "1.0.0"
71+
},
72+
{
73+
"name": "aws_guardduty",
74+
"version": "1.0.0"
75+
},
76+
{
77+
"name": "aws_inspector",
78+
"version": "1.0.0"
79+
},
80+
{
81+
"name": "aws_msk",
82+
"version": "1.0.0"
83+
},
84+
{
85+
"name": "aws_networkfirewall",
86+
"version": "1.0.0"
87+
},
88+
{
89+
"name": "aws_opensearch",
90+
"version": "1.0.0"
91+
},
92+
{
93+
"name": "aws_r53resolver",
94+
"version": "1.0.0"
95+
},
96+
{
97+
"name": "aws_rds",
98+
"version": "1.0.0"
99+
},
100+
{
101+
"name": "aws_s3accesslog",
102+
"version": "1.0.0"
103+
},
104+
{
105+
"name": "aws_securityhub",
106+
"version": "1.0.0"
107+
},
108+
{
109+
"name": "aws_trustedadvisor",
110+
"version": "1.0.0"
111+
},
112+
{
113+
"name": "aws_vpcflowlogs",
114+
"version": "1.0.0"
115+
},
116+
{
117+
"name": "aws_waf",
118+
"version": "1.0.0"
119+
},
120+
{
121+
"name": "aws_workspace",
122+
"version": "1.0.0"
123+
},
124+
{
125+
"name": "log_ecs",
126+
"version": "1.0.0"
127+
},
128+
{
129+
"name": "log_linux",
130+
"version": "1.0.0"
131+
},
132+
{
133+
"name": "log_ocsf",
134+
"version": "1.0.0"
135+
},
136+
{
137+
"name": "log_win",
138+
"version": "1.0.0"
139+
},
140+
{
141+
"name": "logs_aws_clientvpc",
142+
"version": "1.0.0"
143+
},
144+
{
145+
"name": "logs_aws_cloudfront",
146+
"version": "1.0.0"
147+
},
148+
{
149+
"name": "logs_aws_cloudhsm",
150+
"version": "1.0.0"
151+
},
152+
{
153+
"name": "logs_aws_cloudtrail",
154+
"version": "1.0.0"
155+
},
156+
{
157+
"name": "logs_aws_config",
158+
"version": "1.0.0"
159+
},
160+
{
161+
"name": "logs_aws_elasticache",
162+
"version": "1.0.0"
163+
},
164+
{
165+
"name": "logs_aws_elb",
166+
"version": "1.0.0"
167+
},
168+
{
169+
"name": "logs_aws_guardduty",
170+
"version": "1.0.0"
171+
},
172+
{
173+
"name": "logs_aws_inspector",
174+
"version": "1.0.0"
175+
},
176+
{
177+
"name": "logs_aws_msk",
178+
"version": "1.0.0"
179+
},
180+
{
181+
"name": "logs_aws_networkfirewall",
182+
"version": "1.0.0"
183+
},
184+
{
185+
"name": "logs_aws_opensearch",
186+
"version": "1.0.0"
187+
},
188+
{
189+
"name": "logs_aws_r53resolver",
190+
"version": "1.0.0"
191+
},
192+
{
193+
"name": "logs_aws_rds",
194+
"version": "1.0.0"
195+
},
196+
{
197+
"name": "logs_aws_s3accesslog",
198+
"version": "1.0.0"
199+
},
200+
{
201+
"name": "logs_aws_securityhub",
202+
"version": "1.0.0"
203+
},
204+
{
205+
"name": "logs_aws_trustedadvisor",
206+
"version": "1.0.0"
207+
},
208+
{
209+
"name": "logs_aws_vpcflowlogs",
210+
"version": "1.0.0"
211+
},
212+
{
213+
"name": "logs_aws_waf",
214+
"version": "1.0.0"
215+
},
216+
{
217+
"name": "logs_aws_workspaces",
218+
"version": "1.0.0"
219+
},
220+
{
221+
"name": "logs_linux",
222+
"version": "1.0.0"
223+
},
224+
{
225+
"name": "logs_ocsf",
226+
"version": "1.0.0"
227+
},
228+
{
229+
"name": "logs_win",
230+
"version": "1.0.0"
231+
},
232+
{
233+
"name": "logs_win_directory_service",
234+
"version": "1.0.0"
235+
},
236+
{
237+
"name": "logs_win_fsx",
44238
"version": "1.0.0"
45239
},
46240
{
47-
"name": "cloud",
241+
"name": "metrics_opensearch",
48242
"version": "1.0.0"
49243
},
50244
{
51-
"name": "logs-aws_cloudfront",
245+
"name": "opensearch",
52246
"version": "1.0.0"
53247
}
54248
],
@@ -64,28 +258,36 @@
64258
"version": "1.0.0",
65259
"extension": "sql",
66260
"type": "query",
67-
"workflows": ["queries"]
261+
"workflows": [
262+
"queries"
263+
]
68264
},
69265
{
70266
"name": "example_queries",
71267
"version": "1.0.0",
72268
"extension": "ndjson",
73269
"type": "savedObjectBundle",
74-
"workflows": ["queries"]
270+
"workflows": [
271+
"queries"
272+
]
75273
},
76274
{
77275
"name": "create_mv",
78276
"version": "1.0.0",
79277
"extension": "sql",
80278
"type": "query",
81-
"workflows": ["dashboards"]
279+
"workflows": [
280+
"dashboards"
281+
]
82282
},
83283
{
84284
"name": "aws_cloudfront",
85285
"version": "1.0.0",
86286
"extension": "ndjson",
87287
"type": "savedObjectBundle",
88-
"workflows": ["dashboards"]
288+
"workflows": [
289+
"dashboards"
290+
]
89291
}
90292
],
91293
"sampleData": {

Diff for: ‎server/adaptors/integrations/__data__/repository/ocsf-security/schemas/aws-config-1.0.0.json

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"template": {
3+
"_meta": {
4+
"version": "1.0.0",
5+
"catalog": "security",
6+
"type": "logs",
7+
"component": "aws-config",
8+
"labels": [
9+
"aws",
10+
"config"
11+
]
12+
},
13+
"settings": {
14+
"refresh_interval": "30s",
15+
"number_of_shards": "1"
16+
},
17+
"mappings" : {
18+
"properties": {
19+
"awsRegion": {"type": "keyword"},
20+
"configuration.AWS:AWSComponent.Content": {"type": "nested", "properties": {
21+
"InstalledTime": {"type": "date"}}},
22+
"configuration.AWS:Application.Content": {"type": "nested", "properties": {
23+
"InstalledTime": {"type": "date"}}},
24+
"configuration.AWS:ComplianceItem.Content.Association": {"type": "nested", "properties": {
25+
"InstalledTime": {"type": "date"}}},
26+
"configuration.AWS:ComplianceItem.Content.Patch": {"type": "nested", "properties": {
27+
"InstalledTime": {"type": "date"}}},
28+
"configuration.AWS:Network.Content": {"type": "nested"},
29+
"configuration.AWS:WindowsUpdate.Content": {"type": "nested", "properties": {
30+
"InstalledTime": {"type": "date"}}},
31+
"configuration.CreatedTimestamp": {"type": "date"},
32+
"configuration.LastModifiedTimestamp": {"type": "date"},
33+
"configuration.Owner": {"type": "keyword"},
34+
"configuration.alarmConfigurationUpdatedTimestamp": {"type": "date"},
35+
"configuration.billingModeSummary.lastUpdateToPayPerRequestDateTime": {"type": "date"},
36+
"configuration.createTime": {"type": "date"},
37+
"configuration.createdDate": {"type": "date"},
38+
"configuration.createdTime": {"type": "date"},
39+
"configuration.creationDate": {"type": "date"},
40+
"configuration.creationDateTime": {"type": "date"},
41+
"configuration.creationTime": {"type": "date"},
42+
"configuration.creationTimestamp": {"type": "date"},
43+
"configuration.clusterCreateTime": {"type": "date"},
44+
"configuration.dateCreated": {"type": "date"},
45+
"configuration.dateModified": {"type": "date"},
46+
"configuration.dateUpdated": {"type": "date"},
47+
"configuration.deleteTime": {"type": "date"},
48+
"configuration.deletionDate": {"type": "date"},
49+
"configuration.deletionTime": {"type": "date"},
50+
"configuration.configRuleList": {"type": "nested"},
51+
"configuration.lastUpdatedDate": {"type": "date"},
52+
"configuration.lastUpdatedTime": {"type": "date"},
53+
"configuration.metadata.created": {"type": "date"},
54+
"configuration.provisionedThroughput.lastIncreaseDateTime": {"type": "date"},
55+
"configuration.rules.statement": {"type": "text"},
56+
"configuration.serviceSoftwareOptions.automatedUpdateDate": {"type": "date"},
57+
"configuration.snapshotCreateTime": {"type": "date"},
58+
"configuration.state": {"type": "keyword"},
59+
"configuration.state_code": {"type": "keyword"},
60+
"configurationStateId": {"type": "keyword"},
61+
"newEvaluationResult.configRuleInvokedTime": {"type": "date"},
62+
"newEvaluationResult.evaluationResultIdentifier.orderingTimestamp": {"type": "date"},
63+
"newEvaluationResult.resultRecordedTime": {"type": "date"},
64+
"notificationCreationTime": {"type": "date"},
65+
"oldEvaluationResult.configRuleInvokedTime": {"type": "date"},
66+
"oldEvaluationResult.evaluationResultIdentifier.orderingTimestamp": {"type": "date"},
67+
"oldEvaluationResult.resultRecordedTime": {"type": "date"},
68+
"supplementaryConfiguration.StackResourceSummaries": {"type": "nested", "properties": {
69+
"lastUpdatedTimestamp": {"type": "date"}}},
70+
"supplementaryConfiguration.BucketNotificationConfiguration.configurations": {"type": "nested"},
71+
"supplementaryConfiguration.BucketReplicationConfiguration.rules": {"type": "nested"}
72+
}
73+
}
74+
}
75+
}
76+

Diff for: ‎server/adaptors/integrations/__data__/repository/ocsf-security/schemas/aws_clientvpn-1.0.0.json

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"template": {
3+
"_meta": {
4+
"version": "1.0.0",
5+
"catalog": "security",
6+
"type": "logs",
7+
"component": "aws_clientVPN",
8+
"labels": ["aws", "clientVPN"]
9+
},
10+
"settings": {
11+
"refresh_interval": "30s",
12+
"number_of_shards": "1"
13+
},
14+
"mappings" : {
15+
"properties": {
16+
"clientvpn.client-ip": {"type": "ip"},
17+
"clientvpn.client-vpn-endpoint-id": {"type": "keyword"},
18+
"clientvpn.common-name": {"type": "keyword"},
19+
"clientvpn.connection-attempt-failure-reason": {"type": "keyword"},
20+
"clientvpn.connection-attempt-status": {"type": "keyword"},
21+
"clientvpn.connection-duration-seconds": {"type": "keyword"},
22+
"clientvpn.connection-end-time": {"type": "date"},
23+
"clientvpn.connection-id": {"type": "keyword"},
24+
"clientvpn.connection-last-update-time": {"type": "date"},
25+
"clientvpn.connection-log-type": {"type": "keyword"},
26+
"clientvpn.connection-reset-status": {"type": "keyword"},
27+
"clientvpn.connection-start-time": {"type": "date"},
28+
"clientvpn.device-ip": {"type": "ip"},
29+
"clientvpn.device-type": {"type": "keyword"},
30+
"clientvpn.egress-bytes": {"type": "long"},
31+
"clientvpn.egress-packets": {"type": "long"},
32+
"clientvpn.ingress-bytes": {"type": "long"},
33+
"clientvpn.ingress-packets": {"type": "long"},
34+
"clientvpn.port": {"type": "long"},
35+
"clientvpn.transport-protocol": {"type": "keyword"},
36+
"clientvpn.username": {"type": "keyword"}
37+
}
38+
}
39+
}
40+
}

0 commit comments

Comments
 (0)