Skip to content

Commit 09c46a7

Browse files
shaeqahmedshaeqahmed
committed
ZScaler Zia - initial commit tests
1 parent c6feffd commit 09c46a7

37 files changed

+2377
-0
lines changed

‎examples/zscaler_zia_alerts/fields/base-fields.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
- name: data_stream.type
2+
type: constant_keyword
3+
description: Data stream type.
4+
- name: data_stream.dataset
5+
type: constant_keyword
6+
description: Data stream dataset.
7+
- name: data_stream.namespace
8+
type: constant_keyword
9+
description: Data stream namespace.
10+
- name: '@timestamp'
11+
type: date
12+
description: Event timestamp.
13+
- name: event.module
14+
type: constant_keyword
15+
description: Event module.
16+
value: zscaler_zia
17+
- name: event.dataset
18+
type: constant_keyword
19+
description: Event dataset.
20+
value: zscaler_zia.alerts

‎examples/zscaler_zia_alerts/fields/beats.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- name: input.type
2+
type: keyword
3+
description: Type of Filebeat input.
4+
- name: log.offset
5+
type: long
6+
description: Log offset.
7+
- name: tags
8+
type: keyword
9+
description: User defined tags.

‎examples/zscaler_zia_alerts/fields/fields.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- name: zscaler_zia.alerts
2+
type: group
3+
fields:
4+
- name: connection_lost_minutes
5+
type: double
6+
description: |
7+
Amount of time after loosing connection to a server in Minutes.
8+
- name: log_feed_name
9+
type: keyword
10+
description: |
11+
Name of the NSS log feed.
12+
- name: log.source.address
13+
type: keyword
14+
description: Source address from which the log event was read / sent from.

‎examples/zscaler_zia_alerts/log_source.yml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: zscaler_zia_alerts
2+
3+
schema:
4+
ecs_field_names:
5+
- event.dataset
6+
- event.module
7+
- log.syslog.priority
8+
- related.ip
9+
- related.user
10+
- tags
11+
fields:
12+
- name: zscaler_zia
13+
type:
14+
type: struct
15+
fields:
16+
- name: alerts
17+
type:
18+
type: struct
19+
fields:
20+
- name: connection_lost_minutes
21+
type: double
22+
- name: log_feed_name
23+
type: string
24+
25+
transform: |
26+
.event.original = del(.message)
27+
28+
_grokked, err = parse_groks(.event.original, ["^<%{NUMBER:log.syslog.priority}>%{SYSLOGTIMESTAMP:_tmp.timestamp} \\[%{IPORHOST:destination.address}\\] %{GREEDYDATA:message}$"])
29+
if err == null {
30+
. |= _grokked
31+
}
32+
33+
_grokked, err = parse_groks(.message, ["^ZscalerNSS: Zscaler cloud configuration connection to %{IPORHOST:destination.address}:%{NUMBER:destination.port} lost and unavailable for the past %{NUMBER:zscaler_zia.alerts.connection_lost_minutes} minutes$", "^ZscalerNSS: SIEM Feed connection \"%{GREEDYDATA:zscaler_zia.alerts.log_feed_name}\" to %{IPORHOST:destination.address}:%{NUMBER:destination.port} lost and unavailable for the past %{NUMBER:zscaler_zia.alerts.connection_lost_minutes} minutes$"])
34+
if err == null {
35+
. |= _grokked
36+
}
37+
38+
.zscaler_zia.alerts.connection_lost_minutes = to_float(.zscaler_zia.alerts.connection_lost_minutes) ?? null
39+
.log.syslog.priority = to_int(.log.syslog.priority) ?? null
40+
.destination.port = to_int(.destination.port) ?? null
41+
42+
if .destination.address != null {
43+
.destination.ip = to_string!(.destination.address)
44+
}
45+
46+
if .destination.ip != null {
47+
.related.ip = push!(.related.ip, .destination.ip)
48+
}
49+
50+
if !is_nullish(._tmp.timestamp) {
51+
.ts = to_timestamp!(._tmp.timestamp, "seconds")
52+
}

‎examples/zscaler_zia_alerts/test/test-alerts.log

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<114>Dec 31 12:01:04 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes
2+
<114>Dec 31 13:02:05 [81.2.69.193] ZscalerNSS: SIEM Feed connection "DNS Logs Feed" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes
3+
<114>Dec 31 14:03:06 [81.2.69.193] Hey, that's a new type of alert. Isn't it?

‎examples/zscaler_zia_alerts/test/test-alerts.log-expected.json

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2023-12-31T12:01:04.000Z",
5+
"destination": {
6+
"address": "175.16.199.1",
7+
"ip": "175.16.199.1",
8+
"port": 443
9+
},
10+
"ecs": {
11+
"version": "8.6.0"
12+
},
13+
"event": {
14+
"original": "\u003c114\u003eDec 31 12:01:04 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes"
15+
},
16+
"log": {
17+
"syslog": {
18+
"priority": 114
19+
}
20+
},
21+
"message": "ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes",
22+
"related": {
23+
"ip": [
24+
"175.16.199.1"
25+
]
26+
},
27+
"tags": [
28+
"preserve_original_event"
29+
],
30+
"zscaler_zia": {
31+
"alerts": {
32+
"connection_lost_minutes": 2325.0
33+
}
34+
}
35+
},
36+
{
37+
"@timestamp": "2023-12-31T13:02:05.000Z",
38+
"destination": {
39+
"address": "81.2.69.193",
40+
"ip": "81.2.69.193",
41+
"port": 9012
42+
},
43+
"ecs": {
44+
"version": "8.6.0"
45+
},
46+
"event": {
47+
"original": "\u003c114\u003eDec 31 13:02:05 [81.2.69.193] ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes"
48+
},
49+
"log": {
50+
"syslog": {
51+
"priority": 114
52+
}
53+
},
54+
"message": "ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes",
55+
"related": {
56+
"ip": [
57+
"81.2.69.193"
58+
]
59+
},
60+
"tags": [
61+
"preserve_original_event"
62+
],
63+
"zscaler_zia": {
64+
"alerts": {
65+
"connection_lost_minutes": 2440.0,
66+
"log_feed_name": "DNS Logs Feed"
67+
}
68+
}
69+
},
70+
{
71+
"@timestamp": "2023-12-31T14:03:06.000Z",
72+
"destination": {
73+
"address": "81.2.69.193",
74+
"ip": "81.2.69.193"
75+
},
76+
"ecs": {
77+
"version": "8.6.0"
78+
},
79+
"event": {
80+
"original": "\u003c114\u003eDec 31 14:03:06 [81.2.69.193] Hey, that's a new type of alert. Isn't it?"
81+
},
82+
"log": {
83+
"syslog": {
84+
"priority": 114
85+
}
86+
},
87+
"message": "Hey, that's a new type of alert. Isn't it?",
88+
"related": {
89+
"ip": [
90+
"81.2.69.193"
91+
]
92+
},
93+
"tags": [
94+
"preserve_original_event"
95+
]
96+
}
97+
]
98+
}

‎examples/zscaler_zia_alerts/test/test-common-config.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
dynamic_fields:
2+
"@timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}"
3+
fields:
4+
tags:
5+
- preserve_original_event

‎examples/zscaler_zia_dns/fields/base-fields.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
- name: data_stream.type
2+
type: constant_keyword
3+
description: Data stream type.
4+
- name: data_stream.dataset
5+
type: constant_keyword
6+
description: Data stream dataset.
7+
- name: data_stream.namespace
8+
type: constant_keyword
9+
description: Data stream namespace.
10+
- name: '@timestamp'
11+
type: date
12+
description: Event timestamp.
13+
- name: event.module
14+
type: constant_keyword
15+
description: Event module.
16+
value: zscaler_zia
17+
- name: event.dataset
18+
type: constant_keyword
19+
description: Event dataset.
20+
value: zscaler_zia.dns

‎examples/zscaler_zia_dns/fields/beats.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- name: input.type
2+
type: keyword
3+
description: Type of Filebeat input.
4+
- name: log.offset
5+
type: long
6+
description: Log offset.
7+
- name: tags
8+
type: keyword
9+
description: User defined tags.

‎examples/zscaler_zia_dns/fields/fields.yml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
- name: zscaler_zia.dns
2+
type: group
3+
fields:
4+
- name: department
5+
type: keyword
6+
description: |
7+
Department of the user.
8+
- name: dom.category
9+
type: keyword
10+
description: |
11+
URL Category of the FQDN in the DNS request.
12+
- name: duration.milliseconds
13+
type: long
14+
description: |
15+
Duration of the DNS request in milliseconds.
16+
- name: hostname
17+
type: keyword
18+
description: |
19+
N/A
20+
- name: location
21+
type: keyword
22+
description: |
23+
Gateway location or sub-location of the source.
24+
- name: request
25+
type: group
26+
fields:
27+
- name: action
28+
type: keyword
29+
description: |
30+
Name of the action that was applied to the DNS request.
31+
- name: rule.label
32+
type: keyword
33+
description: |
34+
Name of the rule that was applied to the DNS request.
35+
- name: response
36+
type: group
37+
fields:
38+
- name: action
39+
type: keyword
40+
description: |
41+
Name of the action that was applied to the DNS response.
42+
- name: rule.label
43+
type: keyword
44+
description: |-
45+
Name of the rule that was applied to the DNS response.
46+
- name: log.source.address
47+
type: keyword
48+
description: Source address from which the log event was read / sent from.

0 commit comments

Comments
 (0)