Skip to content

Commit 09c46a7

Browse files
shaeqahmedshaeqahmed
committed
ZScaler Zia - initial commit tests
1 parent c6feffd commit 09c46a7

37 files changed

+2377
-0
lines changed

‎examples/zscaler_zia_alerts/fields/base-fields.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
- name: data_stream.type
2+
type: constant_keyword
3+
description: Data stream type.
4+
- name: data_stream.dataset
5+
type: constant_keyword
6+
description: Data stream dataset.
7+
- name: data_stream.namespace
8+
type: constant_keyword
9+
description: Data stream namespace.
10+
- name: '@timestamp'
11+
type: date
12+
description: Event timestamp.
13+
- name: event.module
14+
type: constant_keyword
15+
description: Event module.
16+
value: zscaler_zia
17+
- name: event.dataset
18+
type: constant_keyword
19+
description: Event dataset.
20+
value: zscaler_zia.alerts

‎examples/zscaler_zia_alerts/fields/beats.yml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- name: input.type
2+
type: keyword
3+
description: Type of Filebeat input.
4+
- name: log.offset
5+
type: long
6+
description: Log offset.
7+
- name: tags
8+
type: keyword
9+
description: User defined tags.

‎examples/zscaler_zia_alerts/fields/fields.yml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- name: zscaler_zia.alerts
2+
type: group
3+
fields:
4+
- name: connection_lost_minutes
5+
type: double
6+
description: |
7+
Amount of time after loosing connection to a server in Minutes.
8+
- name: log_feed_name
9+
type: keyword
10+
description: |
11+
Name of the NSS log feed.
12+
- name: log.source.address
13+
type: keyword
14+
description: Source address from which the log event was read / sent from.

‎examples/zscaler_zia_alerts/log_source.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: zscaler_zia_alerts
2+
3+
schema:
4+
ecs_field_names:
5+
- event.dataset
6+
- event.module
7+
- log.syslog.priority
8+
- related.ip
9+
- related.user
10+
- tags
11+
fields:
12+
- name: zscaler_zia
13+
type:
14+
type: struct
15+
fields:
16+
- name: alerts
17+
type:
18+
type: struct
19+
fields:
20+
- name: connection_lost_minutes
21+
type: double
22+
- name: log_feed_name
23+
type: string
24+
25+
transform: |
26+
.event.original = del(.message)
27+
28+
_grokked, err = parse_groks(.event.original, ["^<%{NUMBER:log.syslog.priority}>%{SYSLOGTIMESTAMP:_tmp.timestamp} \\[%{IPORHOST:destination.address}\\] %{GREEDYDATA:message}$"])
29+
if err == null {
30+
. |= _grokked
31+
}
32+
33+
_grokked, err = parse_groks(.message, ["^ZscalerNSS: Zscaler cloud configuration connection to %{IPORHOST:destination.address}:%{NUMBER:destination.port} lost and unavailable for the past %{NUMBER:zscaler_zia.alerts.connection_lost_minutes} minutes$", "^ZscalerNSS: SIEM Feed connection \"%{GREEDYDATA:zscaler_zia.alerts.log_feed_name}\" to %{IPORHOST:destination.address}:%{NUMBER:destination.port} lost and unavailable for the past %{NUMBER:zscaler_zia.alerts.connection_lost_minutes} minutes$"])
34+
if err == null {
35+
. |= _grokked
36+
}
37+
38+
.zscaler_zia.alerts.connection_lost_minutes = to_float(.zscaler_zia.alerts.connection_lost_minutes) ?? null
39+
.log.syslog.priority = to_int(.log.syslog.priority) ?? null
40+
.destination.port = to_int(.destination.port) ?? null
41+
42+
if .destination.address != null {
43+
.destination.ip = to_string!(.destination.address)
44+
}
45+
46+
if .destination.ip != null {
47+
.related.ip = push!(.related.ip, .destination.ip)
48+
}
49+
50+
if !is_nullish(._tmp.timestamp) {
51+
.ts = to_timestamp!(._tmp.timestamp, "seconds")
52+
}

‎examples/zscaler_zia_alerts/test/test-alerts.log

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<114>Dec 31 12:01:04 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes
2+
<114>Dec 31 13:02:05 [81.2.69.193] ZscalerNSS: SIEM Feed connection "DNS Logs Feed" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes
3+
<114>Dec 31 14:03:06 [81.2.69.193] Hey, that's a new type of alert. Isn't it?

‎examples/zscaler_zia_alerts/test/test-alerts.log-expected.json

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2023-12-31T12:01:04.000Z",
5+
"destination": {
6+
"address": "175.16.199.1",
7+
"ip": "175.16.199.1",
8+
"port": 443
9+
},
10+
"ecs": {
11+
"version": "8.6.0"
12+
},
13+
"event": {
14+
"original": "\u003c114\u003eDec 31 12:01:04 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes"
15+
},
16+
"log": {
17+
"syslog": {
18+
"priority": 114
19+
}
20+
},
21+
"message": "ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes",
22+
"related": {
23+
"ip": [
24+
"175.16.199.1"
25+
]
26+
},
27+
"tags": [
28+
"preserve_original_event"
29+
],
30+
"zscaler_zia": {
31+
"alerts": {
32+
"connection_lost_minutes": 2325.0
33+
}
34+
}
35+
},
36+
{
37+
"@timestamp": "2023-12-31T13:02:05.000Z",
38+
"destination": {
39+
"address": "81.2.69.193",
40+
"ip": "81.2.69.193",
41+
"port": 9012
42+
},
43+
"ecs": {
44+
"version": "8.6.0"
45+
},
46+
"event": {
47+
"original": "\u003c114\u003eDec 31 13:02:05 [81.2.69.193] ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes"
48+
},
49+
"log": {
50+
"syslog": {
51+
"priority": 114
52+
}
53+
},
54+
"message": "ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes",
55+
"related": {
56+
"ip": [
57+
"81.2.69.193"
58+
]
59+
},
60+
"tags": [
61+
"preserve_original_event"
62+
],
63+
"zscaler_zia": {
64+
"alerts": {
65+
"connection_lost_minutes": 2440.0,
66+
"log_feed_name": "DNS Logs Feed"
67+
}
68+
}
69+
},
70+
{
71+
"@timestamp": "2023-12-31T14:03:06.000Z",
72+
"destination": {
73+
"address": "81.2.69.193",
74+
"ip": "81.2.69.193"
75+
},
76+
"ecs": {
77+
"version": "8.6.0"
78+
},
79+
"event": {
80+
"original": "\u003c114\u003eDec 31 14:03:06 [81.2.69.193] Hey, that's a new type of alert. Isn't it?"
81+
},
82+
"log": {
83+
"syslog": {
84+
"priority": 114
85+
}
86+
},
87+
"message": "Hey, that's a new type of alert. Isn't it?",
88+
"related": {
89+
"ip": [
90+
"81.2.69.193"
91+
]
92+
},
93+
"tags": [
94+
"preserve_original_event"
95+
]
96+
}
97+
]
98+
}

‎examples/zscaler_zia_alerts/test/test-common-config.yml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
dynamic_fields:
2+
"@timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}"
3+
fields:
4+
tags:
5+
- preserve_original_event

‎examples/zscaler_zia_dns/fields/base-fields.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
- name: data_stream.type
2+
type: constant_keyword
3+
description: Data stream type.
4+
- name: data_stream.dataset
5+
type: constant_keyword
6+
description: Data stream dataset.
7+
- name: data_stream.namespace
8+
type: constant_keyword
9+
description: Data stream namespace.
10+
- name: '@timestamp'
11+
type: date
12+
description: Event timestamp.
13+
- name: event.module
14+
type: constant_keyword
15+
description: Event module.
16+
value: zscaler_zia
17+
- name: event.dataset
18+
type: constant_keyword
19+
description: Event dataset.
20+
value: zscaler_zia.dns

‎examples/zscaler_zia_dns/fields/beats.yml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- name: input.type
2+
type: keyword
3+
description: Type of Filebeat input.
4+
- name: log.offset
5+
type: long
6+
description: Log offset.
7+
- name: tags
8+
type: keyword
9+
description: User defined tags.

‎examples/zscaler_zia_dns/fields/fields.yml

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
- name: zscaler_zia.dns
2+
type: group
3+
fields:
4+
- name: department
5+
type: keyword
6+
description: |
7+
Department of the user.
8+
- name: dom.category
9+
type: keyword
10+
description: |
11+
URL Category of the FQDN in the DNS request.
12+
- name: duration.milliseconds
13+
type: long
14+
description: |
15+
Duration of the DNS request in milliseconds.
16+
- name: hostname
17+
type: keyword
18+
description: |
19+
N/A
20+
- name: location
21+
type: keyword
22+
description: |
23+
Gateway location or sub-location of the source.
24+
- name: request
25+
type: group
26+
fields:
27+
- name: action
28+
type: keyword
29+
description: |
30+
Name of the action that was applied to the DNS request.
31+
- name: rule.label
32+
type: keyword
33+
description: |
34+
Name of the rule that was applied to the DNS request.
35+
- name: response
36+
type: group
37+
fields:
38+
- name: action
39+
type: keyword
40+
description: |
41+
Name of the action that was applied to the DNS response.
42+
- name: rule.label
43+
type: keyword
44+
description: |-
45+
Name of the rule that was applied to the DNS response.
46+
- name: log.source.address
47+
type: keyword
48+
description: Source address from which the log event was read / sent from.

‎examples/zscaler_zia_dns/test/test-common-config.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
fields:
2+
tags:
3+
- preserve_original_event

‎examples/zscaler_zia_dns/test/test-dns-http-endpoint.log

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"sourcetype":"zscalernss-dns","input": {"type": "http_endpoint"}, "event":{"location":"Unknown","deviceowner":"NA","devicehostname":"NA","dns_req":"Unknown","resaction":"None","durationms":"34000","category":"Other","resrulelabel":"None","dns_reqtype":"NotFound","dns_resp":"NotFound","department":"Unknown","user":"Unknown","reqaction":"None","datetime":"Tue Dec 31 02:22:22 2021","srv_dip":"0.0.0.0","clt_sip":"0.0.0.0","reqrulelabel":"None","srv_dport":"0"}}

‎examples/zscaler_zia_dns/test/test-dns-http-endpoint.log-expected.json

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2021-12-31T02:22:22.000Z",
5+
"destination": {
6+
"ip": "0.0.0.0",
7+
"port": 0
8+
},
9+
"dns": {
10+
"answers": {
11+
"name": "NotFound"
12+
},
13+
"question": {
14+
"name": "Unknown",
15+
"type": "NotFound"
16+
}
17+
},
18+
"ecs": {
19+
"version": "8.6.0"
20+
},
21+
"event": {
22+
"category": [
23+
"network"
24+
],
25+
"duration": 34000000000,
26+
"kind": "event",
27+
"original": "{\"sourcetype\":\"zscalernss-dns\",\"input\": {\"type\": \"http_endpoint\"}, \"event\":{\"location\":\"Unknown\",\"deviceowner\":\"NA\",\"devicehostname\":\"NA\",\"dns_req\":\"Unknown\",\"resaction\":\"None\",\"durationms\":\"34000\",\"category\":\"Other\",\"resrulelabel\":\"None\",\"dns_reqtype\":\"NotFound\",\"dns_resp\":\"NotFound\",\"department\":\"Unknown\",\"user\":\"Unknown\",\"reqaction\":\"None\",\"datetime\":\"Tue Dec 31 02:22:22 2021\",\"srv_dip\":\"0.0.0.0\",\"clt_sip\":\"0.0.0.0\",\"reqrulelabel\":\"None\",\"srv_dport\":\"0\"}}",
28+
"type": [
29+
"info"
30+
]
31+
},
32+
"network": {
33+
"protocol": "dns"
34+
},
35+
"related": {
36+
"ip": [
37+
"0.0.0.0"
38+
]
39+
},
40+
"source": {
41+
"ip": "0.0.0.0"
42+
},
43+
"tags": [
44+
"preserve_original_event"
45+
],
46+
"user": {
47+
"email": "Unknown"
48+
},
49+
"zscaler_zia": {
50+
"dns": {
51+
"department": "Unknown",
52+
"dom": {
53+
"category": "Other"
54+
},
55+
"duration": {
56+
"milliseconds": 34000
57+
},
58+
"location": "Unknown",
59+
"request": {
60+
"action": "None",
61+
"rule": {
62+
"label": "None"
63+
}
64+
},
65+
"response": {
66+
"action": "None",
67+
"rule": {
68+
"label": "None"
69+
}
70+
}
71+
}
72+
}
73+
}
74+
]
75+
}

‎examples/zscaler_zia_dns/test/test-dns.log

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{ "sourcetype" : "zscalernss-dns", "event" :{"datetime":"Fri Dec 31 01:11:11 2021","user":"[email protected]","department":"Unknown","location":"TestLoc%20DB","reqaction":"REQ_ALLOW","resaction":"Some Response Action","reqrulelabel":"Access%20Blocked","resrulelabel":"None","dns_reqtype":"Some type","dns_req":"example.com","dns_resp":"Some response string","srv_dport":"8080","durationms":"123456","clt_sip":"89.160.20.112","srv_dip":"89.160.20.156","category":"Professional Services","deviceowner":"Owner77","devicehostname":"Machine9000"}}

0 commit comments

Comments
 (0)