From 8cded633512a0835ac77ee0776757b9372a150b5 Mon Sep 17 00:00:00 2001 From: Alex Resnick Date: Thu, 22 Sep 2022 20:41:06 -0700 Subject: [PATCH] [Barracuda CloudGen] Add initial Barracuda CloudGen Firewall integration (#3796) Add initial Barracuda CloudGen Firewall integration for receiving Firewall Insight logs as described at https://campus.barracuda.com/product/cloudgenfirewall/doc/96025953/how-to-enable-filebeat-stream-to-a-logstash-pipeline. Elastic Agent starts a server to receive data sent over the Lumberjack protocol by CloudGen firewall. (This is the same protocol used between Beats and Logstash.) Co-authored-by: Andrew Kroh --- .github/CODEOWNERS | 1 + .../_dev/build/build.yml | 3 + .../_dev/build/docs/README.md | 28 ++ .../_dev/deploy/docker/docker-compose.yml | 17 ++ .../deploy/docker/sample_logs/firewall.ndjson | 1 + .../deploy/docker/sample_logs/thread.ndjson | 3 + .../_dev/deploy/docker/sample_logs/web.ndjson | 2 + .../barracuda_cloudgen_firewall/changelog.yml | 6 + .../log/_dev/test/pipeline/test-firewall.log | 1 + .../pipeline/test-firewall.log-config.yml | 9 + .../pipeline/test-firewall.log-expected.json | 97 +++++++ .../log/_dev/test/pipeline/test-threat.log | 3 + .../test/pipeline/test-threat.log-config.yml | 9 + .../pipeline/test-threat.log-expected.json | 215 ++++++++++++++ .../log/_dev/test/pipeline/test-web.log | 2 + .../test/pipeline/test-web.log-config.yml | 9 + .../test/pipeline/test-web.log-expected.json | 199 +++++++++++++ .../test/system/test-lumberjack-config.yml | 7 + .../log/agent/stream/lumberjack.yml.hbs | 22 ++ .../elasticsearch/ingest_pipeline/default.yml | 185 ++++++++++++ .../ingest_pipeline/firewall.yml | 208 ++++++++++++++ .../elasticsearch/ingest_pipeline/threat.yml | 126 ++++++++ .../log/elasticsearch/ingest_pipeline/web.yml | 126 ++++++++ .../data_stream/log/fields/base-fields.yml | 20 ++ .../data_stream/log/fields/ecs.yml | 196 +++++++++++++ .../data_stream/log/fields/fields.yml | 21 ++ .../data_stream/log/manifest.yml | 65 +++++ .../data_stream/log/sample_event.json | 119 ++++++++ .../docs/README.md | 272 ++++++++++++++++++ .../barracuda_cloudgen_firewall/img/logo.svg | 100 +++++++ .../barracuda_cloudgen_firewall/manifest.yml | 26 ++ 31 files changed, 2098 insertions(+) create mode 100644 packages/barracuda_cloudgen_firewall/_dev/build/build.yml create mode 100644 packages/barracuda_cloudgen_firewall/_dev/build/docs/README.md create mode 100644 packages/barracuda_cloudgen_firewall/_dev/deploy/docker/docker-compose.yml create mode 100644 packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/firewall.ndjson create mode 100644 packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/thread.ndjson create mode 100644 packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/web.ndjson create mode 100644 packages/barracuda_cloudgen_firewall/changelog.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-config.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-config.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-expected.json create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-config.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-expected.json create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/system/test-lumberjack-config.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/agent/stream/lumberjack.yml.hbs create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/firewall.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/threat.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/web.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/fields/base-fields.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/fields/ecs.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/fields/fields.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/manifest.yml create mode 100644 packages/barracuda_cloudgen_firewall/data_stream/log/sample_event.json create mode 100644 packages/barracuda_cloudgen_firewall/docs/README.md create mode 100644 packages/barracuda_cloudgen_firewall/img/logo.svg create mode 100644 packages/barracuda_cloudgen_firewall/manifest.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index a08c1002db55..e4e8356361b0 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -26,6 +26,7 @@ /packages/azure @elastic/obs-cloud-monitoring /packages/azure_metrics @elastic/obs-cloud-monitoring /packages/barracuda @elastic/security-external-integrations +/packages/barracuda_cloudgen_firewall @elastic/security-external-integrations /packages/bluecoat @elastic/security-external-integrations /packages/box_events @elastic/security-external-integrations /packages/carbon_black_cloud @elastic/security-external-integrations diff --git a/packages/barracuda_cloudgen_firewall/_dev/build/build.yml b/packages/barracuda_cloudgen_firewall/_dev/build/build.yml new file mode 100644 index 000000000000..8d9e4bf7ac85 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@v8.4.0 diff --git a/packages/barracuda_cloudgen_firewall/_dev/build/docs/README.md b/packages/barracuda_cloudgen_firewall/_dev/build/docs/README.md new file mode 100644 index 000000000000..35cc7e873bea --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/_dev/build/docs/README.md @@ -0,0 +1,28 @@ +# Barracuda CloudGen Firewall integration + +This integration ingests and parses logs from +[Barracuda CloudGen Firewalls](https://www.barracuda.com/products/cloudgenfirewall). + +Barracuda CloudGen Firewall allows you to stream event logs from Firewall +Insights to Elastic Agent. This provides information on firewall activity, +threat logs, and information related to network, version, and location of +managed firewall units. Data is sent to Elastic Agent over a TCP connection +using CloudGen Firewall's built-in generic Logstash output. + +### Setup + +For a detailed walk-through of the setup steps the see +[How to Enable Filebeat Stream to a Logstash Pipeline](https://campus.barracuda.com/product/cloudgenfirewall/doc/96025953/how-to-enable-filebeat-stream-to-a-logstash-pipeline/). +These steps were written with a Logstash server as the intended destination, and +where it references the "Hostname" use the address and port of the Elastic Agent +that is running this integration. Logstash is not used as part of this +integration. + +## Logs + +This is the Barracuda CloudGen Firewall `log` dataset. Below is a sample +event and a list of fields that can be produced. + +{{event "log"}} + +{{fields "log"}} \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/docker-compose.yml b/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 000000000000..3037aa268b81 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,17 @@ +version: '2.3' +services: + barracuda-cloudgen-lumberjack: + image: docker.elastic.co/observability/stream:v0.8.0 + volumes: + - ./sample_logs:/sample_logs:ro + environment: + - STREAM_PROTOCOL=lumberjack + - STREAM_LUMBERJACK_PARSE_JSON=true + - STREAM_ADDR=tcp://elastic-agent:5044 + - STREAM_DELAY=5s + - STREAM_START_SIGNAL=SIGHUP + # The ndjson files contain data that simulates the format of the Logstash + # output from the embedded Filebeat instance in Barracuda CloudGen. + # It contains a JSON string in the 'message' field and some additional + # firewall metadata (like serial number) stored in root level fields. + command: log /sample_logs/*.ndjson diff --git a/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/firewall.ndjson b/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/firewall.ndjson new file mode 100644 index 000000000000..13c52cf143cc --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/firewall.ndjson @@ -0,0 +1 @@ +{"beat": {"hostname": "cgf-scout-int"}, "message":"{\"version\":1,\"timestamp\":1606230141,\"action\":\"End\",\"duration\":8436,\"src_iface\":\"eth0\",\"src_ip\":\"10.17.35.171\",\"src_port\":40532,\"src_mac\":\"00:0c:29:9a:0a:78\",\"dst_iface\":\"eth0\",\"dst_ip\":\"67.43.156.78\",\"dst_port\":443,\"dst_mac\":\"00:0c:29:00:d6:00\",\"fw_rule\":\"BOX-LAN-2-INTERNET\",\"app_rule\":\":ALL-APPS\",\"fw_info\":2007,\"src_ip_nat\":\"10.17.35.175\",\"dst_ip_nat\":\"67.43.156.100\",\"fwd_bytes\":7450,\"rev_bytes\":561503,\"fwd_packets\":129,\"rev_packets\":439,\"ip_proto\":6,\"protos\":[\"HTTPS direct\",\"HTTPS\",\"All HTTP protocols\"],\"apps\":[\"Web browsing\"]}","product":"ngfw","sn":"4f94abdf7a8c465fa2cd76f680ecafd1","type":"ngfw-act"} diff --git a/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/thread.ndjson b/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/thread.ndjson new file mode 100644 index 000000000000..c3dae64a9051 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/thread.ndjson @@ -0,0 +1,3 @@ +{"beat": {"hostname": "cgf-scout-int"}, "message":"{\"app_target\":\"eicar.exe\",\"component\":\"firewall\",\"date\":\"2018 05 15\",\"description\":\"Eicar-Test-Signature\",\"dst_ip\":\"10.0.6.96\",\"operation\":\"Block\",\"port\":\"443\",\"severity\":\"Warning\",\"src_ip\":\"10.17.35.169\",\"threat_severity\":\"3\",\"time\":\"15:42:27\",\"timestamp\":\"2018-05-15T15:42:27+00:00\",\"timezone\":\"+00:00\",\"trans_proto\":\"TCP\",\"type\":\"Virus\",\"user\":\"user42\"}","product":"ngfw","sn":"4f94abdf7a8c465fa2cd76f680ecafd1","type":"ngfw-threat"} +{"beat": {"hostname": "cgf-scout-int"}, "message":"{\"app_target\":\"boese.pdf\",\"component\":\"firewall\",\"date\":\"2018 05 15\",\"description\":\"ad43f5fc1d679c8d766824abb41b2b28b364c3c8;.pdf\",\"dst_ip\":\"89.160.20.129\",\"operation\":\"Block\",\"port\":\"80\",\"severity\":\"Warning\",\"src_ip\":\"10.17.35.169\",\"threat_severity\":\"3\",\"time\":\"15:42:32\",\"timestamp\":\"2018-05-15T15:42:32+00:00\",\"timezone\":\"+00:00\",\"trans_proto\":\"TCP\",\"type\":\"ATD\",\"user\":\"user42\"}","product":"ngfw","sn":"4f94abdf7a8c465fa2cd76f680ecafd1","type":"ngfw-threat"} +{"beat": {"hostname": "cgf-scout-int"}, "message":"{\"component\":\"firewall\",\"date\":\"2018 05 15\",\"description\":\"ID: 1054837 WEB Remote File Inclusion /etc/passwd\",\"dst_ip\":\"89.160.20.130\",\"ips_category\":\"Web Attack\",\"operation\":\"Block\",\"port\":\"80\",\"severity\":\"Warning\",\"src_ip\":\"10.17.35.169\",\"threat_severity\":\"3\",\"time\":\"15:46:06\",\"timestamp\":\"2018-05-15T15:46:06+00:00\",\"timezone\":\"+00:00\",\"trans_proto\":\"TCP\",\"type\":\"IPS\",\"user\":\"user45\"}","product":"ngfw","sn":"4f94abdf7a8c465fa2cd76f680ecafd1","type":"ngfw-threat"} diff --git a/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/web.ndjson b/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/web.ndjson new file mode 100644 index 000000000000..931353c291bc --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/_dev/deploy/docker/sample_logs/web.ndjson @@ -0,0 +1,2 @@ +{"beat": {"hostname": "cgf-scout-int"}, "message":"{\"timestamp\":1526383397000,\"traffic_type\":0,\"action\":0,\"source_ip\":\"192.168.42.124\",\"source_port\":\"50646\",\"destination_ip\":\"175.16.199.12\",\"destination_port\":\"443\",\"method\":\"GET\",\"status_code\":\"200\",\"user_agent\":\"wget/1.19.2 (linux-gnu)\",\"content_type\":\"text/html; charset=UTF-8\",\"name\":\"https://www.heise.de/\",\"size\":59558,\"domain\":\"www.heise.de\",\"category\":[\"79\"],\"user\":\"192.168.42.124\",\"user_type\":0,\"fw_rule\":\"LAN-2-INTERNET\",\"app_rule\":\":\"}","product":"ngfw","sn":"4f94abdf7a8c465fa2cd76f680ecafd1","type":"ngfw-wf"} +{"beat": {"hostname": "cgf-scout-int"}, "message":"{\"timestamp\":1526377804000,\"traffic_type\":0,\"action\":0,\"source_ip\":\"192.168.42.105\",\"source_port\":\"50159\",\"destination_ip\":\"89.160.20.114\",\"destination_port\":\"443\",\"method\":\"GET\",\"status_code\":\"200\",\"user_agent\":\"mozilla/5.0 (windows nt 6.1) applewebkit/537.36 (khtml, like gecko) chrome/66.0.3359.139 safari/537.36\",\"content_type\":\"\",\"name\":\"https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=66\",\"size\":0,\"domain\":\"clientservices.googleapis.com\",\"category\":[],\"user\":\"192.168.42.105\",\"user_type\":0,\"fw_rule\":\"LAN-2-INTERNET\",\"app_rule\":\":\"}","product":"ngfw","sn":"4f94abdf7a8c465fa2cd76f680ecafd1","type":"ngfw-wf"} diff --git a/packages/barracuda_cloudgen_firewall/changelog.yml b/packages/barracuda_cloudgen_firewall/changelog.yml new file mode 100644 index 000000000000..35317a8b52e2 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/changelog.yml @@ -0,0 +1,6 @@ +# newer versions go on top +- version: "0.1.0" + changes: + - description: initial release + type: enhancement # can be one of: enhancement, bugfix, breaking-change + link: https://github.com/elastic/package-storage/pull/3796 diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log new file mode 100644 index 000000000000..a2833a6ea130 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log @@ -0,0 +1 @@ +{"version":1,"timestamp":1606230141,"action":"End","duration":8436,"src_iface":"eth0","src_ip":"10.17.35.171","src_port":40532,"src_mac":"00:0c:29:9a:0a:78","dst_iface":"eth0","dst_ip":"67.43.156.78","dst_port":443,"dst_mac":"00:0c:29:00:d6:00","fw_rule":"BOX-LAN-2-INTERNET","app_rule":":ALL-APPS","fw_info":2007,"src_ip_nat":"10.17.35.175","dst_ip_nat":"67.43.156.100","fwd_bytes":7450,"rev_bytes":561503,"fwd_packets":129,"rev_packets":439,"ip_proto":6,"protos":["HTTPS direct","HTTPS","All HTTP protocols"],"apps":["Web browsing"]} diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-config.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-config.yml new file mode 100644 index 000000000000..b6041d976d67 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-config.yml @@ -0,0 +1,9 @@ +fields: + tags: + - preserve_original_event + lumberjack: + type: ngfw-act + sn: 4f94abdf7a8c465fa2cd76f680ecafd1 + product: ngfw + beat: + hostname: cgf-scout-int diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json new file mode 100644 index 000000000000..a6b38581571e --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json @@ -0,0 +1,97 @@ +{ + "expected": [ + { + "@timestamp": "2020-11-24T15:02:21.000Z", + "barracuda_cloudgen_firewall": { + "log": { + "app_rule": "\u003cApp\u003e:ALL-APPS", + "fw_info": 2007 + } + }, + "destination": { + "address": "67.43.156.78", + "as": { + "number": 35908 + }, + "bytes": 561503, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.78", + "mac": "00-0C-29-00-D6-00", + "nat": { + "ip": "67.43.156.100" + }, + "packets": 439, + "port": 443 + }, + "ecs": { + "version": "8.4.0" + }, + "event": { + "action": "End", + "category": [ + "network" + ], + "duration": 8436000000, + "kind": "event", + "original": "{\"version\":1,\"timestamp\":1606230141,\"action\":\"End\",\"duration\":8436,\"src_iface\":\"eth0\",\"src_ip\":\"10.17.35.171\",\"src_port\":40532,\"src_mac\":\"00:0c:29:9a:0a:78\",\"dst_iface\":\"eth0\",\"dst_ip\":\"67.43.156.78\",\"dst_port\":443,\"dst_mac\":\"00:0c:29:00:d6:00\",\"fw_rule\":\"BOX-LAN-2-INTERNET\",\"app_rule\":\"\u003cApp\u003e:ALL-APPS\",\"fw_info\":2007,\"src_ip_nat\":\"10.17.35.175\",\"dst_ip_nat\":\"67.43.156.100\",\"fwd_bytes\":7450,\"rev_bytes\":561503,\"fwd_packets\":129,\"rev_packets\":439,\"ip_proto\":6,\"protos\":[\"HTTPS direct\",\"HTTPS\",\"All HTTP protocols\"],\"apps\":[\"Web browsing\"]}", + "type": [ + "end" + ] + }, + "network": { + "community_id": "1:HGU1tX9W2VUF5ND2ey3X6Niv/AQ=", + "iana_number": "6", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "egress": { + "interface": { + "name": "eth0" + } + }, + "hostname": "cgf-scout-int", + "ingress": { + "interface": { + "name": "eth0" + } + }, + "product": "ngfw", + "serial_number": "4f94abdf7a8c465fa2cd76f680ecafd1", + "type": "firewall", + "vendor": "Barracuda" + }, + "related": { + "ip": [ + "10.17.35.171", + "67.43.156.78" + ] + }, + "rule": { + "name": "BOX-LAN-2-INTERNET" + }, + "source": { + "address": "10.17.35.171", + "bytes": 7450, + "ip": "10.17.35.171", + "mac": "00-0C-29-9A-0A-78", + "nat": { + "ip": "10.17.35.175" + }, + "packets": 129, + "port": 40532 + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log new file mode 100644 index 000000000000..b258d9f1b91a --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log @@ -0,0 +1,3 @@ +{"app_target":"eicar.exe","component":"firewall","date":"2018 05 15","description":"Eicar-Test-Signature","dst_ip":"10.0.6.96","operation":"Block","port":"443","severity":"Warning","src_ip":"10.17.35.169","threat_severity":"3","time":"15:42:27","timestamp":"2018-05-15T15:42:27+00:00","timezone":"+00:00","trans_proto":"TCP","type":"Virus","user":"user42"} +{"app_target":"boese.pdf","component":"firewall","date":"2018 05 15","description":"ad43f5fc1d679c8d766824abb41b2b28b364c3c8;.pdf","dst_ip":"89.160.20.129","operation":"Block","port":"80","severity":"Warning","src_ip":"10.17.35.169","threat_severity":"3","time":"15:42:32","timestamp":"2018-05-15T15:42:32+00:00","timezone":"+00:00","trans_proto":"TCP","type":"ATD","user":"user42"} +{"component":"firewall","date":"2018 05 15","description":"ID: 1054837 WEB Remote File Inclusion /etc/passwd","dst_ip":"89.160.20.130","ips_category":"Web Attack","operation":"Block","port":"80","severity":"Warning","src_ip":"10.17.35.169","threat_severity":"3","time":"15:46:06","timestamp":"2018-05-15T15:46:06+00:00","timezone":"+00:00","trans_proto":"TCP","type":"IPS","user":"user45"} diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-config.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-config.yml new file mode 100644 index 000000000000..692adf9da87f --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-config.yml @@ -0,0 +1,9 @@ +fields: + tags: + - preserve_original_event + lumberjack: + type: ngfw-threat + sn: 4f94abdf7a8c465fa2cd76f680ecafd1 + product: ngfw + beat: + hostname: cgf-scout-int diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-expected.json b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-expected.json new file mode 100644 index 000000000000..c819c627be15 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-expected.json @@ -0,0 +1,215 @@ +{ + "expected": [ + { + "@timestamp": "2018-05-15T15:42:27.000Z", + "destination": { + "address": "10.0.6.96", + "ip": "10.0.6.96", + "port": 443 + }, + "ecs": { + "version": "8.4.0" + }, + "event": { + "action": "block", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"app_target\":\"eicar.exe\",\"component\":\"firewall\",\"date\":\"2018 05 15\",\"description\":\"Eicar-Test-Signature\",\"dst_ip\":\"10.0.6.96\",\"operation\":\"Block\",\"port\":\"443\",\"severity\":\"Warning\",\"src_ip\":\"10.17.35.169\",\"threat_severity\":\"3\",\"time\":\"15:42:27\",\"timestamp\":\"2018-05-15T15:42:27+00:00\",\"timezone\":\"+00:00\",\"trans_proto\":\"TCP\",\"type\":\"Virus\",\"user\":\"user42\"}", + "severity": 3, + "type": [ + "denied" + ] + }, + "log": { + "level": "Warning" + }, + "network": { + "iana_number": "6", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "hostname": "cgf-scout-int", + "product": "ngfw", + "serial_number": "4f94abdf7a8c465fa2cd76f680ecafd1", + "type": "firewall", + "vendor": "Barracuda" + }, + "related": { + "ip": [ + "10.17.35.169", + "10.0.6.96" + ] + }, + "rule": { + "description": "Eicar-Test-Signature", + "ruleset": "Virus" + }, + "source": { + "address": "10.17.35.169", + "ip": "10.17.35.169" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user42" + } + }, + { + "@timestamp": "2018-05-15T15:42:32.000Z", + "destination": { + "address": "89.160.20.129", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 80 + }, + "ecs": { + "version": "8.4.0" + }, + "event": { + "action": "block", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"app_target\":\"boese.pdf\",\"component\":\"firewall\",\"date\":\"2018 05 15\",\"description\":\"ad43f5fc1d679c8d766824abb41b2b28b364c3c8;.pdf\",\"dst_ip\":\"89.160.20.129\",\"operation\":\"Block\",\"port\":\"80\",\"severity\":\"Warning\",\"src_ip\":\"10.17.35.169\",\"threat_severity\":\"3\",\"time\":\"15:42:32\",\"timestamp\":\"2018-05-15T15:42:32+00:00\",\"timezone\":\"+00:00\",\"trans_proto\":\"TCP\",\"type\":\"ATD\",\"user\":\"user42\"}", + "severity": 3, + "type": [ + "denied" + ] + }, + "log": { + "level": "Warning" + }, + "network": { + "iana_number": "6", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "hostname": "cgf-scout-int", + "product": "ngfw", + "serial_number": "4f94abdf7a8c465fa2cd76f680ecafd1", + "type": "firewall", + "vendor": "Barracuda" + }, + "related": { + "ip": [ + "10.17.35.169", + "89.160.20.129" + ] + }, + "rule": { + "description": "ad43f5fc1d679c8d766824abb41b2b28b364c3c8;.pdf", + "ruleset": "ATD" + }, + "source": { + "address": "10.17.35.169", + "ip": "10.17.35.169" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user42" + } + }, + { + "@timestamp": "2018-05-15T15:46:06.000Z", + "destination": { + "address": "89.160.20.130", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.130", + "port": 80 + }, + "ecs": { + "version": "8.4.0" + }, + "event": { + "action": "block", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"component\":\"firewall\",\"date\":\"2018 05 15\",\"description\":\"ID: 1054837 WEB Remote File Inclusion /etc/passwd\",\"dst_ip\":\"89.160.20.130\",\"ips_category\":\"Web Attack\",\"operation\":\"Block\",\"port\":\"80\",\"severity\":\"Warning\",\"src_ip\":\"10.17.35.169\",\"threat_severity\":\"3\",\"time\":\"15:46:06\",\"timestamp\":\"2018-05-15T15:46:06+00:00\",\"timezone\":\"+00:00\",\"trans_proto\":\"TCP\",\"type\":\"IPS\",\"user\":\"user45\"}", + "severity": 3, + "type": [ + "denied" + ] + }, + "log": { + "level": "Warning" + }, + "network": { + "iana_number": "6", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "hostname": "cgf-scout-int", + "product": "ngfw", + "serial_number": "4f94abdf7a8c465fa2cd76f680ecafd1", + "type": "firewall", + "vendor": "Barracuda" + }, + "related": { + "ip": [ + "10.17.35.169", + "89.160.20.130" + ] + }, + "rule": { + "category": "Web Attack", + "description": "ID: 1054837 WEB Remote File Inclusion /etc/passwd", + "ruleset": "IPS" + }, + "source": { + "address": "10.17.35.169", + "ip": "10.17.35.169" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user45" + } + } + ] +} \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log new file mode 100644 index 000000000000..dcc1d7edd5cf --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log @@ -0,0 +1,2 @@ +{"timestamp":1526383397000,"traffic_type":0,"action":0,"source_ip":"192.168.42.124","source_port":"50646","destination_ip":"175.16.199.12","destination_port":"443","method":"GET","status_code":"200","user_agent":"wget/1.19.2 (linux-gnu)","content_type":"text/html; charset=UTF-8","name":"https://www.heise.de/","size":59558,"domain":"www.heise.de","category":["79"],"user":"192.168.42.124","user_type":0,"fw_rule":"LAN-2-INTERNET","app_rule":":"} +{"timestamp":1526377804000,"traffic_type":0,"action":0,"source_ip":"192.168.42.105","source_port":"50159","destination_ip":"89.160.20.114","destination_port":"443","method":"GET","status_code":"200","user_agent":"mozilla/5.0 (windows nt 6.1) applewebkit/537.36 (khtml, like gecko) chrome/66.0.3359.139 safari/537.36","content_type":"","name":"https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=66","size":0,"domain":"clientservices.googleapis.com","category":[],"user":"192.168.42.105","user_type":0,"fw_rule":"LAN-2-INTERNET","app_rule":":"} diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-config.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-config.yml new file mode 100644 index 000000000000..1e271969114a --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-config.yml @@ -0,0 +1,9 @@ +fields: + tags: + - preserve_original_event + lumberjack: + type: ngfw-wf + sn: 4f94abdf7a8c465fa2cd76f680ecafd1 + product: ngfw + beat: + hostname: cgf-scout-int diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-expected.json b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-expected.json new file mode 100644 index 000000000000..793fa7a366e7 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-expected.json @@ -0,0 +1,199 @@ +{ + "expected": [ + { + "@timestamp": "2018-05-15T11:23:17.000Z", + "barracuda_cloudgen_firewall": { + "log": { + "app_rule": "\u003cApp\u003e:\u003cpass-no-match\u003e", + "traffic_type": 0, + "user_type": "0" + } + }, + "destination": { + "address": "175.16.199.12", + "geo": { + "city_name": "Changchun", + "continent_name": "Asia", + "country_iso_code": "CN", + "country_name": "China", + "location": { + "lat": 43.88, + "lon": 125.3228 + }, + "region_iso_code": "CN-22", + "region_name": "Jilin Sheng" + }, + "ip": "175.16.199.12", + "port": 443 + }, + "ecs": { + "version": "8.4.0" + }, + "event": { + "action": "0", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"timestamp\":1526383397000,\"traffic_type\":0,\"action\":0,\"source_ip\":\"192.168.42.124\",\"source_port\":\"50646\",\"destination_ip\":\"175.16.199.12\",\"destination_port\":\"443\",\"method\":\"GET\",\"status_code\":\"200\",\"user_agent\":\"wget/1.19.2 (linux-gnu)\",\"content_type\":\"text/html; charset=UTF-8\",\"name\":\"https://www.heise.de/\",\"size\":59558,\"domain\":\"www.heise.de\",\"category\":[\"79\"],\"user\":\"192.168.42.124\",\"user_type\":0,\"fw_rule\":\"LAN-2-INTERNET\",\"app_rule\":\"\u003cApp\u003e:\u003cpass-no-match\u003e\"}", + "type": [ + "allowed" + ] + }, + "http": { + "request": { + "method": "GET", + "mime_type": "text/html; charset=UTF-8" + }, + "response": { + "body": { + "bytes": 59558 + }, + "status_code": 200 + } + }, + "network": { + "type": "ipv4" + }, + "observer": { + "hostname": "cgf-scout-int", + "product": "ngfw", + "serial_number": "4f94abdf7a8c465fa2cd76f680ecafd1", + "type": "firewall", + "vendor": "Barracuda" + }, + "related": { + "ip": [ + "192.168.42.124", + "175.16.199.12" + ] + }, + "rule": { + "name": "LAN-2-INTERNET" + }, + "source": { + "address": "192.168.42.124", + "ip": "192.168.42.124", + "port": 50646 + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "www.heise.de", + "original": "https://www.heise.de/", + "path": "/", + "scheme": "https" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "wget/1.19.2 (linux-gnu)", + "os": { + "name": "Linux" + } + } + }, + { + "@timestamp": "2018-05-15T09:50:04.000Z", + "barracuda_cloudgen_firewall": { + "log": { + "app_rule": "\u003cApp\u003e:\u003cpass-no-match\u003e", + "traffic_type": 0, + "user_type": "0" + } + }, + "destination": { + "address": "89.160.20.114", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.114", + "port": 443 + }, + "ecs": { + "version": "8.4.0" + }, + "event": { + "action": "0", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"timestamp\":1526377804000,\"traffic_type\":0,\"action\":0,\"source_ip\":\"192.168.42.105\",\"source_port\":\"50159\",\"destination_ip\":\"89.160.20.114\",\"destination_port\":\"443\",\"method\":\"GET\",\"status_code\":\"200\",\"user_agent\":\"mozilla/5.0 (windows nt 6.1) applewebkit/537.36 (khtml, like gecko) chrome/66.0.3359.139 safari/537.36\",\"content_type\":\"\",\"name\":\"https://clientservices.googleapis.com/chrome-variations/seed?osname=win\u0026channel=stable\u0026milestone=66\",\"size\":0,\"domain\":\"clientservices.googleapis.com\",\"category\":[],\"user\":\"192.168.42.105\",\"user_type\":0,\"fw_rule\":\"LAN-2-INTERNET\",\"app_rule\":\"\u003cApp\u003e:\u003cpass-no-match\u003e\"}", + "type": [ + "allowed" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "body": { + "bytes": 0 + }, + "status_code": 200 + } + }, + "network": { + "type": "ipv4" + }, + "observer": { + "hostname": "cgf-scout-int", + "product": "ngfw", + "serial_number": "4f94abdf7a8c465fa2cd76f680ecafd1", + "type": "firewall", + "vendor": "Barracuda" + }, + "related": { + "ip": [ + "192.168.42.105", + "89.160.20.114" + ] + }, + "rule": { + "name": "LAN-2-INTERNET" + }, + "source": { + "address": "192.168.42.105", + "ip": "192.168.42.105", + "port": 50159 + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "clientservices.googleapis.com", + "original": "https://clientservices.googleapis.com/chrome-variations/seed?osname=win\u0026channel=stable\u0026milestone=66", + "path": "/chrome-variations/seed", + "query": "osname=win\u0026channel=stable\u0026milestone=66", + "scheme": "https" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "mozilla/5.0 (windows nt 6.1) applewebkit/537.36 (khtml, like gecko) chrome/66.0.3359.139 safari/537.36" + } + } + ] +} \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/system/test-lumberjack-config.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/system/test-lumberjack-config.yml new file mode 100644 index 000000000000..5a20cc81d8b8 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/system/test-lumberjack-config.yml @@ -0,0 +1,7 @@ +service: barracuda-cloudgen-lumberjack +service_notify_signal: SIGHUP +input: lumberjack +data_stream: + vars: + listen_address: '0.0.0.0' + listen_port: 5044 diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/agent/stream/lumberjack.yml.hbs b/packages/barracuda_cloudgen_firewall/data_stream/log/agent/stream/lumberjack.yml.hbs new file mode 100644 index 000000000000..4219e58cc8bb --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/agent/stream/lumberjack.yml.hbs @@ -0,0 +1,22 @@ +listen_address: "{{listen_address}}:{{listen_port}}" +versions: +{{#each versions as |v i|}} + - {{v}} +{{/each}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if ssl}} +ssl: {{ssl}} +{{/if}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 000000000000..51d0f96f9a01 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,185 @@ +--- +description: Pipeline for Barracuda CloudGen Firewall +processors: + - set: + field: ecs.version + value: '8.4.0' + + # Metadata about the origin of the event captured from the Lumberjack connection. + - rename: + field: source.address + target_field: labels.origin_address + ignore_missing: true + - rename: + field: tls.client.subject + target_field: labels.origin_client_subject + ignore_missing: true + - remove: + field: + - source + - tls + ignore_missing: true + + - set: + field: observer.vendor + value: Barracuda + - set: + field: observer.type + value: firewall + - rename: + description: Set observer.hostname from beat.hostname (Beats 6.x). + field: lumberjack.beat.hostname + target_field: observer.hostname + ignore_missing: true + - rename: + description: Set observer.hostname from agent.name (Beats 7.x+). + if: ctx.observer?.hostname == null + field: lumberjack.agent.hostname + target_field: observer.hostname + ignore_missing: true + - rename: + field: lumberjack.product + target_field: observer.product + ignore_missing: true + - rename: + field: lumberjack.sn + target_field: observer.serial_number + ignore_missing: true + - rename: + field: lumberjack.message + target_field: event.original + ignore_missing: true + - rename: + field: message + target_field: event.original + if: ctx.event?.original == null + - remove: + field: message + ignore_missing: true + - json: + field: event.original + target_field: json + - pipeline: + name: '{{ IngestPipeline "firewall" }}' + if: ctx.lumberjack?.type == 'ngfw-act' + - pipeline: + name: '{{ IngestPipeline "web" }}' + if: ctx.lumberjack?.type == 'ngfw-wf' + - pipeline: + name: '{{ IngestPipeline "threat" }}' + if: ctx.lumberjack?.type == 'ngfw-threat' + + # Overwrite the @timestamp. Never enter a state where the event does not + # have a '@timestamp' because it is required for indexing. + - set: + description: Overwrite @timestamp with the value parsed from the JSON. + field: '@timestamp' + copy_from: '_tmp.timestamp' + ignore_empty_value: true + + - set: + field: network.type + value: ipv4 + if: 'ctx.source?.ip != null && ctx.source?.ip.contains(".")' + - set: + field: network.type + value: ipv6 + if: 'ctx.source?.ip != null && ctx.source?.ip.contains(":")' + - community_id: + target_field: network.community_id + ignore_failure: true + + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + - append: + field: related.ip + value: '{{{source.ip}}}' + allow_duplicates: false + if: ctx.source?.ip != null && ctx.source?.ip != '' + - append: + field: related.ip + value: '{{{destination.ip}}}' + allow_duplicates: false + if: ctx.destination?.ip != null && ctx.destination?.ip != '' + - remove: + field: + - json + - lumberjack + - _tmp + ignore_missing: true + - script: + description: This script processor iterates over the whole document to remove fields with null values. + tag: remove-null-recursive + lang: painless + source: | + void handleMap(Map map) { + for (def x : map.values()) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + map.values().removeIf(v -> v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0)); + } + void handleList(List list) { + for (def x : list) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + list.removeIf(v -> v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0)); + } + handleMap(ctx); + - remove: + field: event.original + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" + ignore_failure: true + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/firewall.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/firewall.yml new file mode 100644 index 000000000000..17166426db71 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/firewall.yml @@ -0,0 +1,208 @@ +--- +description: Pipeline for Barracuda CloudGen Firewall Activity Messages logs +processors: + - date: + field: json.timestamp + target_field: '_tmp.timestamp' + formats: + - UNIX + - rename: + field: json.src_ip + target_field: source.address + ignore_missing: true + if: ctx.json?.src_ip != '-' + - convert: + field: source.address + target_field: source.ip + type: ip + ignore_missing: true + ignore_failure: true + - convert: + field: json.src_port + target_field: source.port + type: long + ignore_missing: true + - rename: + field: json.src_iface + target_field: observer.ingress.interface.name + ignore_missing: true + - gsub: + field: json.src_mac + target_field: source.mac + pattern: '[-:.]' + replacement: '-' + ignore_missing: true + if: ctx.json?.src_mac != '00:00:00:00:00:00' + - convert: + field: json.src_ip_nat + target_field: source.nat.ip + type: ip + ignore_missing: true + if: ctx.json?.src_ip_nat != '0.0.0.0' + - convert: + field: json.fwd_bytes + target_field: source.bytes + type: long + ignore_missing: true + - convert: + field: json.fwd_packets + target_field: source.packets + type: long + ignore_missing: true + - rename: + field: json.dst_ip + target_field: destination.address + ignore_missing: true + if: ctx.json?.dst_ip != '-' + - convert: + field: destination.address + target_field: destination.ip + type: ip + ignore_missing: true + - convert: + field: json.dst_port + target_field: destination.port + type: long + ignore_missing: true + - rename: + field: json.dst_iface + target_field: observer.egress.interface.name + ignore_missing: true + - gsub: + field: json.dst_mac + target_field: destination.mac + pattern: '[-:.]' + replacement: '-' + ignore_missing: true + if: ctx.json?.dst_mac != '00:00:00:00:00:00' + - convert: + field: json.dst_ip_nat + target_field: destination.nat.ip + type: ip + ignore_missing: true + if: ctx.json?.dst_ip_nat != '0.0.0.0' + - uppercase: + field: destination.mac + ignore_missing: true + - uppercase: + field: source.mac + ignore_missing: true + - gsub: + field: destination.mac + pattern: '[.:]' + replacement: '-' + ignore_missing: true + - gsub: + field: source.mac + pattern: '[.:]' + replacement: '-' + ignore_missing: true + - convert: + field: json.rev_bytes + target_field: destination.bytes + type: long + ignore_missing: true + - convert: + field: json.rev_packets + target_field: destination.packets + type: long + ignore_missing: true + - rename: + field: json.fw_rule + target_field: rule.name + ignore_missing: true + - rename: + field: json.app_rule + target_field: barracuda_cloudgen_firewall.log.app_rule + ignore_missing: true + - rename: + field: json.fw_info + target_field: barracuda_cloudgen_firewall.log.fw_info + ignore_missing: true + if: ctx.json?.fw_info != '-' + - rename: + field: json.action + target_field: event.action + ignore_missing: true + - script: + description: Convert duration of the session in milliseconds to nanoseconds. + tag: duration-ms-to-ns + lang: painless + if: ctx.json?.duration != null + source: >- + ctx.event.duration = (long)ctx.json.duration * 1000000; + - script: + description: Compute network.bytes sum. + tag: sum-network-bytes + lang: painless + source: "ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes" + if: ctx.source?.bytes != null && ctx.destination?.bytes != null && ctx.network?.bytes == null + ignore_failure: true + - script: + description: Compute network.packets sum. + tag: sum-network-packets + lang: painless + source: "ctx.network.packets = ctx.source.packets + ctx.destination.packets" + if: ctx.source?.packets != null && ctx.destination?.packets != null && ctx.network?.packets == null + ignore_failure: true + - convert: + field: json.ip_proto + target_field: network.iana_number + type: string + ignore_missing: true + - rename: + field: json.user + target_field: user.name + ignore_missing: true + - script: + description: Enrich with network.transport based on IANA number. + tag: enrich-network-transport-name + lang: painless + ignore_failure: true + if: ctx.network?.iana_number != null + source: | + def iana_number = ctx.network.iana_number; + if (iana_number == '0') { + ctx.network.transport = 'hopopt'; + } else if (iana_number == '1') { + ctx.network.transport = 'icmp'; + } else if (iana_number == '2') { + ctx.network.transport = 'igmp'; + } else if (iana_number == '6') { + ctx.network.transport = 'tcp'; + } else if (iana_number == '8') { + ctx.network.transport = 'egp'; + } else if (iana_number == '17') { + ctx.network.transport = 'udp'; + } else if (iana_number == '47') { + ctx.network.transport = 'gre'; + } else if (iana_number == '50') { + ctx.network.transport = 'esp'; + } else if (iana_number == '58') { + ctx.network.transport = 'ipv6-icmp'; + } else if (iana_number == '112') { + ctx.network.transport = 'vrrp'; + } else if (iana_number == '132') { + ctx.network.transport = 'sctp'; + } + - set: + field: event.kind + value: event + - append: + field: event.category + value: network + allow_duplicates: false + - append: + field: event.type + value: denied + allow_duplicates: false + if: ctx.event.action == 'AppBlock' + - append: + field: event.type + value: end + allow_duplicates: false + if: ctx.event.action == 'End' +on_failure: + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/threat.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/threat.yml new file mode 100644 index 000000000000..e4f59f6fe86b --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/threat.yml @@ -0,0 +1,126 @@ +--- +description: Pipeline for Barracuda CloudGen Firewall Threat logs +processors: + - date: + field: json.timestamp + target_field: _tmp.timestamp + formats: + - ISO8601 + if: ctx.json?.timestamp != null && ctx.json?.timestamp != '' && ctx.json?.timestamp != '-' + - set: + description: Use the syslog date / time when timestamp is missing. + field: _tmp.syslog_timestamp + value: "{{{json.date}}} {{{json.time}}}" + if: ctx._tmp?.timestamp == null + - date: + description: Parse syslog date / time / timezone. + field: _tmp.syslog_timestamp + target_field: _tmp.timestamp + formats: + - yyyy MM dd HH:mm:ss + timezone: '{{{ json.timezone }}}' + if: ctx._tmp?.timestamp == null + - rename: + field: json.src_ip + target_field: source.address + ignore_missing: true + if: ctx.json?.src_ip != '-' + - convert: + field: source.address + target_field: source.ip + type: ip + ignore_missing: true + - rename: + field: json.dst_ip + target_field: destination.address + ignore_missing: true + if: ctx.json?.dst_ip != '-' + - convert: + field: destination.address + target_field: destination.ip + type: ip + ignore_missing: true + - convert: + field: json.port + target_field: destination.port + type: long + ignore_missing: true + if: ctx.json?.port != '-' + - rename: + field: json.severity + target_field: log.level + ignore_missing: true + if: ctx.json?.severity != '-' + - rename: + field: json.fw_rule + target_field: rule.name + ignore_missing: true + - rename: + field: json.trans_proto + target_field: network.transport + ignore_missing: true + if: ctx.json?.trans_proto != '-' + - lowercase: + field: network.transport + ignore_missing: true + - set: + field: network.iana_number + value: '6' + if: ctx.network?.transport == "tcp" + - set: + field: network.iana_number + value: '17' + if: ctx.network?.transport == "udp" + - rename: + field: json.description + target_field: rule.description + ignore_missing: true + - convert: + field: json.threat_severity + target_field: event.severity + type: long + ignore_missing: true + if: ctx.json?.threat_severity != '-' + - rename: + field: json.ips_category + target_field: rule.category + ignore_missing: true + - rename: + field: json.type + target_field: rule.ruleset + ignore_missing: true + if: ctx.json?.type != '-' + - rename: + field: json.app_proto + target_field: barracuda_cloudgen_firewall.log.app_proto + ignore_missing: true + - rename: + field: json.user + target_field: user.name + ignore_missing: true + - lowercase: + field: json.operation + target_field: event.action + ignore_missing: true + if: ctx.json?.operation != '-' + - set: + field: event.kind + value: event + - append: + field: event.category + value: network + allow_duplicates: false + - append: + field: event.type + value: denied + allow_duplicates: false + if: ctx.event.action == 'block' + - append: + field: event.type + value: allowed + allow_duplicates: false + if: ctx.event.action == 'allow' +on_failure: + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/web.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/web.yml new file mode 100644 index 000000000000..e6362cd93799 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/web.yml @@ -0,0 +1,126 @@ +--- +description: Pipeline for Barracuda CloudGen Firewall Web Messages logs +processors: + - date: + field: json.timestamp + target_field: '_tmp.timestamp' + formats: + - UNIX_MS + if: ctx.json?.timestamp != '-' + - rename: + field: json.source_ip + target_field: source.address + ignore_missing: true + if: ctx.json?.source_ip != '-' + - convert: + field: source.address + target_field: source.ip + type: ip + ignore_missing: true + - convert: + field: json.source_port + target_field: source.port + type: long + ignore_missing: true + if: ctx.json?.source_port != '-' + - rename: + field: json.destination_ip + target_field: destination.address + ignore_missing: true + if: ctx.json?.destination_ip != '-' + - convert: + field: destination.address + target_field: destination.ip + type: ip + ignore_missing: true + - convert: + field: json.destination_port + target_field: destination.port + type: long + ignore_missing: true + if: ctx.json?.destination_port != '-' + - rename: + field: json.method + target_field: http.request.method + ignore_missing: true + - convert: + field: json.status_code + target_field: http.response.status_code + type: long + ignore_missing: true + if: ctx.json?.status_code != '0' + - user_agent: + field: json.user_agent + ignore_missing: true + - rename: + field: json.content_type + target_field: http.request.mime_type + ignore_missing: true + - uri_parts: + field: json.name + ignore_failure: true + - rename: + field: json.domain + target_field: http.request.referrer + ignore_missing: true + if: ctx.json?.domain != null && ctx.json?.domain != "" && (/^https?:\/\/.*$/.matcher(ctx.json?.domain)).matches() + - set: + field: url.domain + value: "{{{destination.domain}}}" + if: ctx.url?.domain == null && ctx.destination?.domain != null + - convert: + field: json.size + target_field: http.response.body.bytes + type: long + ignore_missing: true + if: ctx.json?.size != '0' + - convert: + field: json.user_type + target_field: barracuda_cloudgen_firewall.log.user_type + type: string + ignore_missing: true + if: ctx.json?.user_type != null && ctx.json?.user_type != '-' + - rename: + field: json.user + target_field: user.name + ignore_missing: true + if: ctx.json?.user != null && ctx.json?.user != '-' && ctx.barracuda_cloudgen_firewall?.log?.user_type == 1 + - rename: + field: json.traffic_type + target_field: barracuda_cloudgen_firewall.log.traffic_type + ignore_missing: true + if: ctx.json?.traffic_type != null && ctx.json?.traffic_type != '-' + - rename: + field: json.fw_rule + target_field: rule.name + ignore_missing: true + - rename: + field: json.app_rule + target_field: barracuda_cloudgen_firewall.log.app_rule + ignore_missing: true + - convert: + field: json.action + target_field: event.action + type: string + ignore_missing: true + - set: + field: event.kind + value: event + - append: + field: event.category + value: network + allow_duplicates: false + - append: + field: event.type + value: denied + allow_duplicates: false + if: ctx.event.action == '1' + - append: + field: event.type + value: allowed + allow_duplicates: false + if: ctx.event.action == '0' +on_failure: + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/fields/base-fields.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/fields/base-fields.yml new file mode 100644 index 000000000000..8369fb02ba4f --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: barracuda_cloudgen_firewall +- name: event.dataset + type: constant_keyword + description: Event dataset + value: barracuda_cloudgen_firewall.log +- name: input.type + description: Type of Filebeat input. + type: keyword diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/fields/ecs.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/fields/ecs.yml new file mode 100644 index 000000000000..bf39f98bbf8e --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/fields/ecs.yml @@ -0,0 +1,196 @@ +- external: ecs + name: '@timestamp' +- external: ecs + name: destination.address +- external: ecs + name: destination.as.number +- external: ecs + name: destination.as.organization.name +- external: ecs + name: destination.bytes +- external: ecs + name: destination.domain +- external: ecs + name: destination.geo.city_name +- external: ecs + name: destination.geo.continent_name +- external: ecs + name: destination.geo.country_iso_code +- external: ecs + name: destination.geo.country_name +- external: ecs + name: destination.geo.location +- external: ecs + name: destination.geo.name +- external: ecs + name: destination.geo.region_iso_code +- external: ecs + name: destination.geo.region_name +- external: ecs + name: destination.ip +- external: ecs + name: destination.mac +- external: ecs + name: destination.nat.ip +- external: ecs + name: destination.packets +- external: ecs + name: destination.port +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.action +- external: ecs + name: event.code +- external: ecs + name: event.ingested +- external: ecs + name: event.original +- external: ecs + name: event.outcome +- external: ecs + name: event.timezone +- external: ecs + name: http.request.body.bytes +- external: ecs + name: http.request.bytes +- external: ecs + name: http.request.method +- external: ecs + name: http.request.mime_type +- external: ecs + name: http.request.referrer +- external: ecs + name: http.response.body.bytes +- external: ecs + name: http.response.bytes +- external: ecs + name: http.response.status_code +- external: ecs + name: http.version +- external: ecs + name: labels +- external: ecs + name: log.level +- external: ecs + name: message +- external: ecs + name: network.community_id +- external: ecs + name: network.iana_number +- external: ecs + name: network.transport +- external: ecs + name: network.type +- external: ecs + name: observer.egress.interface.name +- external: ecs + name: observer.hostname +- external: ecs + name: observer.ingress.interface.name +- external: ecs + name: observer.product +- external: ecs + name: observer.serial_number +- external: ecs + name: observer.type +- external: ecs + name: observer.vendor +- external: ecs + name: observer.version +- external: ecs + name: related.hosts +- external: ecs + name: related.ip +- external: ecs + name: related.user +- external: ecs + name: rule.category +- external: ecs + name: rule.description +- external: ecs + name: rule.name +- external: ecs + name: rule.ruleset +- external: ecs + name: source.address +- external: ecs + name: source.as.number +- external: ecs + name: source.as.organization.name +- external: ecs + name: source.bytes +- external: ecs + name: source.domain +- external: ecs + name: source.geo.city_name +- external: ecs + name: source.geo.continent_name +- external: ecs + name: source.geo.country_iso_code +- external: ecs + name: source.geo.country_name +- external: ecs + name: source.geo.location +- external: ecs + name: source.geo.name +- external: ecs + name: source.geo.region_iso_code +- external: ecs + name: source.geo.region_name +- external: ecs + name: source.ip +- external: ecs + name: source.mac +- external: ecs + name: source.nat.ip +- external: ecs + name: source.packets +- external: ecs + name: source.port +- external: ecs + name: tags +- external: ecs + name: url.domain +- external: ecs + name: url.extension +- external: ecs + name: url.full +- external: ecs + name: url.original +- external: ecs + name: url.password +- external: ecs + name: url.path +- external: ecs + name: url.port +- external: ecs + name: url.query +- external: ecs + name: url.scheme +- external: ecs + name: url.username +- external: ecs + name: user.domain +- external: ecs + name: user.full_name +- external: ecs + name: user.id +- external: ecs + name: user.name +- external: ecs + name: user_agent.device.name +- external: ecs + name: user_agent.name +- external: ecs + name: user_agent.original +- external: ecs + name: user_agent.os.full +- external: ecs + name: user_agent.os.name +- external: ecs + name: user_agent.os.version +- external: ecs + name: user_agent.version diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/fields/fields.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/fields/fields.yml new file mode 100644 index 000000000000..e5337373c576 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/fields/fields.yml @@ -0,0 +1,21 @@ +- name: barracuda_cloudgen_firewall.log + type: group + fields: + - name: app_rule + type: keyword + description: application rule name (e.g. ":ALL-APPS") + - name: fw_info + type: long + description: Detailed information about the action performed by the firewall. More information can be found [here](https://campus.barracuda.com/product/cloudgenfirewall/doc/96025108/how-to-enable-filebeat-stream-to-a-logstash-pipeline/) + - name: user_type + type: keyword + description: User type of web log. 1 if "user" is a username or 0 if "user" is an IP address. + - name: traffic_type + type: long + description: Always "0" +- name: labels.origin_address + type: keyword + description: Remote address where the log originated. +- name: labels.origin_client_subject + type: keyword + description: Distinguished name of subject of the x.509 certificate presented by the origin client when mutual TLS is enabled. diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/manifest.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/manifest.yml new file mode 100644 index 000000000000..7b6f3c002960 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/manifest.yml @@ -0,0 +1,65 @@ +title: Barracuda CloudGen Firewall Logs +release: experimental +type: logs +streams: + - input: lumberjack + title: Firewall Insights logs + description: Receive firewall activity, threat logs, and information related to network, version, and location of managed firewall units. + template_path: lumberjack.yml.hbs + vars: + - name: listen_address + type: text + title: Listen Address + description: The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces. + multi: false + required: true + show_user: true + default: localhost + - name: listen_port + type: integer + title: Listen Port + description: The TCP port number to listen on. + multi: false + required: true + show_user: true + default: 5044 + - name: versions + type: text + title: List of Lumberjack version (e.g. v1, v2). + required: true + show_user: false + multi: true + default: + - v2 + - name: ssl + type: yaml + title: TLS configuration + multi: false + required: false + show_user: true + description: Options for enabling TLS mode. See the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html) for a list of all options. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - barracuda_cloudgen_firewall-log + - forwarded + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/sample_event.json b/packages/barracuda_cloudgen_firewall/data_stream/log/sample_event.json new file mode 100644 index 000000000000..b6cdc63b7581 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/sample_event.json @@ -0,0 +1,119 @@ +{ + "@timestamp": "2020-11-24T15:02:21.000Z", + "agent": { + "ephemeral_id": "b620e757-d3b2-4b59-8c2b-cce4d2f17081", + "id": "70e82165-776e-4b35-98b8-b0c9491f4b6e", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.5.0" + }, + "barracuda_cloudgen_firewall": { + "log": { + "app_rule": "\u003cApp\u003e:ALL-APPS", + "fw_info": 2007 + } + }, + "data_stream": { + "dataset": "barracuda_cloudgen_firewall.log", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "67.43.156.78", + "as": { + "number": 35908 + }, + "bytes": 561503, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.78", + "mac": "00-0C-29-00-D6-00", + "nat": { + "ip": "67.43.156.100" + }, + "packets": 439, + "port": 443 + }, + "ecs": { + "version": "8.4.0" + }, + "elastic_agent": { + "id": "70e82165-776e-4b35-98b8-b0c9491f4b6e", + "snapshot": true, + "version": "8.5.0" + }, + "event": { + "action": "End", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "barracuda_cloudgen_firewall.log", + "duration": -153934592, + "ingested": "2022-09-21T13:30:52Z", + "kind": "event", + "type": [ + "end" + ] + }, + "input": { + "type": "lumberjack" + }, + "labels": { + "origin_address": "172.20.0.4:34752" + }, + "network": { + "community_id": "1:HGU1tX9W2VUF5ND2ey3X6Niv/AQ=", + "iana_number": "6", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "egress": { + "interface": { + "name": "eth0" + } + }, + "hostname": "cgf-scout-int", + "ingress": { + "interface": { + "name": "eth0" + } + }, + "product": "ngfw", + "serial_number": "4f94abdf7a8c465fa2cd76f680ecafd1", + "type": "firewall", + "vendor": "Barracuda" + }, + "related": { + "ip": [ + "10.17.35.171", + "67.43.156.78" + ] + }, + "rule": { + "name": "BOX-LAN-2-INTERNET" + }, + "source": { + "address": "10.17.35.171", + "bytes": 7450, + "ip": "10.17.35.171", + "mac": "00-0C-29-9A-0A-78", + "nat": { + "ip": "10.17.35.175" + }, + "packets": 129, + "port": 40532 + }, + "tags": [ + "barracuda_cloudgen_firewall-log", + "forwarded" + ] +} \ No newline at end of file diff --git a/packages/barracuda_cloudgen_firewall/docs/README.md b/packages/barracuda_cloudgen_firewall/docs/README.md new file mode 100644 index 000000000000..612c04ad073f --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/docs/README.md @@ -0,0 +1,272 @@ +# Barracuda CloudGen Firewall integration + +This integration ingests and parses logs from +[Barracuda CloudGen Firewalls](https://www.barracuda.com/products/cloudgenfirewall). + +Barracuda CloudGen Firewall allows you to stream event logs from Firewall +Insights to Elastic Agent. This provides information on firewall activity, +threat logs, and information related to network, version, and location of +managed firewall units. Data is sent to Elastic Agent over a TCP connection +using CloudGen Firewall's built-in generic Logstash output. + +### Setup + +For a detailed walk-through of the setup steps the see +[How to Enable Filebeat Stream to a Logstash Pipeline](https://campus.barracuda.com/product/cloudgenfirewall/doc/96025953/how-to-enable-filebeat-stream-to-a-logstash-pipeline/). +These steps were written with a Logstash server as the intended destination, and +where it references the "Hostname" use the address and port of the Elastic Agent +that is running this integration. Logstash is not used as part of this +integration. + +## Logs + +This is the Barracuda CloudGen Firewall `log` dataset. Below is a sample +event and a list of fields that can be produced. + +An example event for `log` looks as following: + +```json +{ + "@timestamp": "2020-11-24T15:02:21.000Z", + "agent": { + "ephemeral_id": "b620e757-d3b2-4b59-8c2b-cce4d2f17081", + "id": "70e82165-776e-4b35-98b8-b0c9491f4b6e", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.5.0" + }, + "barracuda_cloudgen_firewall": { + "log": { + "app_rule": "\u003cApp\u003e:ALL-APPS", + "fw_info": 2007 + } + }, + "data_stream": { + "dataset": "barracuda_cloudgen_firewall.log", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "67.43.156.78", + "as": { + "number": 35908 + }, + "bytes": 561503, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.78", + "mac": "00-0C-29-00-D6-00", + "nat": { + "ip": "67.43.156.100" + }, + "packets": 439, + "port": 443 + }, + "ecs": { + "version": "8.4.0" + }, + "elastic_agent": { + "id": "70e82165-776e-4b35-98b8-b0c9491f4b6e", + "snapshot": true, + "version": "8.5.0" + }, + "event": { + "action": "End", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "barracuda_cloudgen_firewall.log", + "duration": -153934592, + "ingested": "2022-09-21T13:30:52Z", + "kind": "event", + "type": [ + "end" + ] + }, + "input": { + "type": "lumberjack" + }, + "labels": { + "origin_address": "172.20.0.4:34752" + }, + "network": { + "community_id": "1:HGU1tX9W2VUF5ND2ey3X6Niv/AQ=", + "iana_number": "6", + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "egress": { + "interface": { + "name": "eth0" + } + }, + "hostname": "cgf-scout-int", + "ingress": { + "interface": { + "name": "eth0" + } + }, + "product": "ngfw", + "serial_number": "4f94abdf7a8c465fa2cd76f680ecafd1", + "type": "firewall", + "vendor": "Barracuda" + }, + "related": { + "ip": [ + "10.17.35.171", + "67.43.156.78" + ] + }, + "rule": { + "name": "BOX-LAN-2-INTERNET" + }, + "source": { + "address": "10.17.35.171", + "bytes": 7450, + "ip": "10.17.35.171", + "mac": "00-0C-29-9A-0A-78", + "nat": { + "ip": "10.17.35.175" + }, + "packets": 129, + "port": 40532 + }, + "tags": [ + "barracuda_cloudgen_firewall-log", + "forwarded" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | +| barracuda_cloudgen_firewall.log.app_rule | application rule name (e.g. "\:ALL-APPS") | keyword | +| barracuda_cloudgen_firewall.log.fw_info | Detailed information about the action performed by the firewall. More information can be found [here](https://campus.barracuda.com/product/cloudgenfirewall/doc/96025108/how-to-enable-filebeat-stream-to-a-logstash-pipeline/) | long | +| barracuda_cloudgen_firewall.log.traffic_type | Always "0" | long | +| barracuda_cloudgen_firewall.log.user_type | User type of web log. 1 if "user" is a username or 0 if "user" is an IP address. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.bytes | Bytes sent from the destination to the source. | long | +| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | +| destination.packets | Packets sent from the destination to the source. | long | +| destination.port | Port of the destination. | long | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.dataset | Event dataset | constant_keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.module | Event module | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | +| http.request.body.bytes | Size in bytes of the request body. | long | +| http.request.bytes | Total size in bytes of the request (body and headers). | long | +| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | +| http.request.mime_type | Mime type of the body of the request. This value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients. | keyword | +| http.request.referrer | Referrer for this HTTP request. | keyword | +| http.response.body.bytes | Size in bytes of the response body. | long | +| http.response.bytes | Total size in bytes of the response (body and headers). | long | +| http.response.status_code | HTTP response status code. | long | +| http.version | HTTP version. | keyword | +| input.type | Type of Filebeat input. | keyword | +| labels | Custom key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: `docker` and `k8s` labels. | object | +| labels.origin_address | Remote address where the log originated. | keyword | +| labels.origin_client_subject | Distinguished name of subject of the x.509 certificate presented by the origin client when mutual TLS is enabled. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | +| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | +| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | +| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | +| observer.egress.interface.name | Interface name as reported by the system. | keyword | +| observer.hostname | Hostname of the observer. | keyword | +| observer.ingress.interface.name | Interface name as reported by the system. | keyword | +| observer.product | The product name of the observer. | keyword | +| observer.serial_number | Observer serial number. | keyword | +| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | +| observer.vendor | Vendor name of the observer. | keyword | +| observer.version | Observer version. | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | +| rule.description | The description of the rule generating the event. | keyword | +| rule.name | The name of the rule or signature generating the event. | keyword | +| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | +| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.bytes | Bytes sent from the source to the destination. | long | +| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | +| source.packets | Packets sent from the source to the destination. | long | +| source.port | Port of the source. | long | +| tags | List of keywords used to tag each event. | keyword | +| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| url.full | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | wildcard | +| url.full.text | Multi-field of `url.full`. | match_only_text | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | +| url.password | Password of the request. | keyword | +| url.path | Path of the request, such as "/search". | wildcard | +| url.port | Port of the request, such as 443. | long | +| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | +| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | +| url.username | Username of the request. | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.full_name | User's full name, if available. | keyword | +| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | +| user_agent.device.name | Name of the device. | keyword | +| user_agent.name | Name of the user agent. | keyword | +| user_agent.original | Unparsed user_agent string. | keyword | +| user_agent.original.text | Multi-field of `user_agent.original`. | match_only_text | +| user_agent.os.full | Operating system name, including the version or code name. | keyword | +| user_agent.os.full.text | Multi-field of `user_agent.os.full`. | match_only_text | +| user_agent.os.name | Operating system name, without the version. | keyword | +| user_agent.os.name.text | Multi-field of `user_agent.os.name`. | match_only_text | +| user_agent.os.version | Operating system version as a raw string. | keyword | +| user_agent.version | Version of the user agent. | keyword | diff --git a/packages/barracuda_cloudgen_firewall/img/logo.svg b/packages/barracuda_cloudgen_firewall/img/logo.svg new file mode 100644 index 000000000000..555cdd6f8a32 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/img/logo.svg @@ -0,0 +1,100 @@ + + + + + + + + + diff --git a/packages/barracuda_cloudgen_firewall/manifest.yml b/packages/barracuda_cloudgen_firewall/manifest.yml new file mode 100644 index 000000000000..8363f23de5e5 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/manifest.yml @@ -0,0 +1,26 @@ +format_version: 1.0.0 +name: barracuda_cloudgen_firewall +title: Barracuda CloudGen Firewall Logs +version: "0.1.0" +description: Collect logs from Barracuda CloudGen Firewall devices with Elastic Agent. +categories: ["network", "security"] +release: experimental +license: basic +type: integration +conditions: + kibana.version: "^8.5.0" +policy_templates: + - name: barracuda_cloudgen_firewall + title: Barracuda CloudGen Firewall Logs + description: Receive firewall activity, threat logs, and information related to network, version, and location of managed firewall units. + inputs: + - type: lumberjack + title: Receive logs from Barracuda via Lumberjack protocol + description: Elastic Agent will listen for incoming connections from Barracuda. +icons: + - src: /img/logo.svg + title: Barracuda logo + size: 32x32 + type: image/svg+xml +owner: + github: elastic/security-external-integrations