Skip to content

Commit 62cdd1a

Browse files
haetamoudihaetamoudi
authored
add support for malformed quotes and log version field
1 parent 2e6cacd commit 62cdd1a

File tree

7 files changed

+93
-1
lines changed

7 files changed

+93
-1
lines changed

‎packages/fortinet_fortiproxy/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.2.3"
3+
changes:
4+
- description: add support for malformed quotes and log version field
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15766
27
- version: "1.2.2"
38
changes:
49
- description: Generate processor tags and normalize error handler.

‎packages/fortinet_fortiproxy/data_stream/log/_dev/test/pipeline/test-example.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,4 @@ date=2017-11-15 time=11:44:16 tz="+0200" logid="0000000013" type="traffic" subty
2828
<189>date=2024-05-09 time=06:20:04 devname="TEST-PXY01" devid="FPXTESTPXY01" eventtime=1715260803895122957 tz="-0700" logid="0000000010" type="traffic" subtype="forward" level="notice" vd="root" srcip=10.0.0.3 srcport=41460 srcintf="port2" srcintfrole="lan" dstcountry="United States" srccountry="Reserved" dstip=67.43.156.171 dstport=443 dstintf="port1" dstintfrole="undefined" sessionid=1781818021 service="HTTPS" proxyapptype="web-proxy" proto=6 action="accept" policyid=1 policytype="proxy-policy" poluuid="27b09930-033d-51ef-0c72-6c1221a8d893" policyname="test-proxy" trandisp="snat" transip=10.0.128.2 transport=7242 clientip=10.0.0.3 duration=12536 wanin=3665 rcvdbyte=3665 wanout=667 lanin=755 sentbyte=755 lanout=3737 appcat="unscanned" utmaction="allow" countssl=1
2929
<189>date=2024-05-09 time=06:21:14 devname="TEST-PXY01" devid="FPXTESTPXY01" eventtime=1715260873739449705 tz="-0700" logid="0100040704" type="event" subtype="system" level="notice" vd="root" logdesc="System performance statistics" action="perf-stats" cpu=0 mem=29 totalsession=38 disk=0 bandwidth="20/20" setuprate=1 disklograte=0 fazlograte=0 freediskstorage=0 sysuptime=166235 waninfo="N/A" msg="Performance statistics: average CPU: 0, memory: 29, concurrent sessions: 38, setup-rate: 1"
3030
<189>date=2024-05-09 time=06:19:39 devname="TEST-PXY01" devid="FPXTESTPXY01" eventtime=1715260778798356673 tz="-0700" logid="0000000010" type="traffic" subtype="forward" level="notice" vd="root" srcip=10.0.0.3 srcport=47886 srcintf="port2" srcintfrole="lan" dstcountry="United States" srccountry="Reserved" dstip=67.43.156.10 dstport=443 dstintf="port1" dstintfrole="undefined" sessionid=1781818019 service="HTTPS" proxyapptype="web-proxy" proto=6 action="accept" policyid=1 policytype="proxy-policy" poluuid="27b09930-033d-51ef-0c72-6c1221a8d893" policyname="test-proxy" trandisp="snat" transip=10.0.128.2 transport=53184 clientip=10.0.0.3 duration=8089 wanin=125800732 rcvdbyte=125800732 wanout=632 lanin=798 sentbyte=798 lanout=125824455 appcat="unscanned" utmaction="allow"
31+
<189>logver=704080649 timestamp=1760084266 devname="TEST-PXY01" devid="FPXTESTPXY01" vd="root" date=2025-10-10 time=08:17:46 eventtime=1760077067153677744 tz="+0200" logid="0000000010" type="event" subtype="user" level="notice" logdesc="Explicit proxy authentication failed" srcip=10.0.0.175 dstip=10.0.0.199 authid="999-WGS-AUTH-DEFAULT" user=""http" authproto="HTTP(10.0.0.175)" action="NTLM-auth" status="failure" url="http://10.0.0.199/" reason="Authentication failed" msg="User "http failed in authentication"

‎packages/fortinet_fortiproxy/data_stream/log/_dev/test/pipeline/test-example.log-expected.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2818,6 +2818,78 @@
28182818
},
28192819
"port": 47886
28202820
}
2821+
},
2822+
{
2823+
"@timestamp": "2025-10-10T06:17:46.000Z",
2824+
"client": {
2825+
"ip": "10.0.0.175"
2826+
},
2827+
"destination": {
2828+
"ip": "10.0.0.199"
2829+
},
2830+
"ecs": {
2831+
"version": "8.17.0"
2832+
},
2833+
"event": {
2834+
"action": "NTLM-auth",
2835+
"category": [
2836+
"network"
2837+
],
2838+
"code": "0000000010",
2839+
"kind": "event",
2840+
"original": "<189>logver=704080649 timestamp=1760084266 devname=\"TEST-PXY01\" devid=\"FPXTESTPXY01\" vd=\"root\" date=2025-10-10 time=08:17:46 eventtime=1760077067153677744 tz=\"+0200\" logid=\"0000000010\" type=\"event\" subtype=\"user\" level=\"notice\" logdesc=\"Explicit proxy authentication failed\" srcip=10.0.0.175 dstip=10.0.0.199 authid=\"999-WGS-AUTH-DEFAULT\" user=\"\"http\" authproto=\"HTTP(10.0.0.175)\" action=\"NTLM-auth\" status=\"failure\" url=\"http://10.0.0.199/\" reason=\"Authentication failed\" msg=\"User \"http failed in authentication\"",
2841+
"reason": "Authentication failed",
2842+
"start": "2025-10-10T06:17:47.153Z",
2843+
"timezone": "+0200"
2844+
},
2845+
"fortinet": {
2846+
"proxy": {
2847+
"authid": "999-WGS-AUTH-DEFAULT",
2848+
"authproto": "HTTP(10.0.0.175)",
2849+
"logver": 704080649,
2850+
"status": "failure",
2851+
"subtype": "user",
2852+
"type": "event",
2853+
"url": "http://10.0.0.199/",
2854+
"user": "\"http",
2855+
"vd": "root"
2856+
}
2857+
},
2858+
"log": {
2859+
"level": "notice",
2860+
"syslog": {
2861+
"facility": {
2862+
"code": 23
2863+
},
2864+
"priority": 189,
2865+
"severity": {
2866+
"code": 5
2867+
}
2868+
}
2869+
},
2870+
"message": "User \"http failed in authentication",
2871+
"observer": {
2872+
"name": "TEST-PXY01",
2873+
"product": "FortiProxy",
2874+
"serial_number": "FPXTESTPXY01",
2875+
"type": "proxy",
2876+
"vendor": "Fortinet"
2877+
},
2878+
"rule": {
2879+
"description": "Explicit proxy authentication failed"
2880+
},
2881+
"server": {
2882+
"ip": "10.0.0.199"
2883+
},
2884+
"source": {
2885+
"ip": "10.0.0.175"
2886+
},
2887+
"url": {
2888+
"domain": "10.0.0.199",
2889+
"original": "http://10.0.0.199/",
2890+
"path": "/",
2891+
"scheme": "http"
2892+
}
28212893
}
28222894
]
28232895
}

‎packages/fortinet_fortiproxy/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,9 @@ processors:
7474
for (int i = 0, n = ctx["message"].length(); i < n; ++i) {
7575
char c = ctx["message"].charAt(i);
7676
if (c == (char)'"') {
77+
if (inQuote && i < n - 1 && ctx["message"].charAt(i + 1) != (char)' ') {
78+
continue;
79+
}
7780
inQuote = !inQuote;
7881
}
7982
if (inQuote) {
@@ -215,6 +218,11 @@ processors:
215218
field: _fields_.wanout
216219
type: long
217220
ignore_missing: true
221+
- convert:
222+
tag: convert_logver
223+
field: _fields_.logver
224+
type: long
225+
ignore_missing: true
218226
219227
# ------------------------------------------------------------------------------
220228
# Enrich fields.
@@ -582,6 +590,7 @@ processors:
582590
- _fields_.agent
583591
- _fields_.clientip
584592
- _fields_.duration
593+
- _fields_.timestamp
585594
ignore_missing: true
586595
- rename:
587596
tag: rename__fields__to_fortinet_proxy_e471e0a7

‎packages/fortinet_fortiproxy/data_stream/log/fields/fields.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1201,6 +1201,10 @@
12011201
type: keyword
12021202
description: >-
12031203
SSH login Name
1204+
- name: logver
1205+
type: long
1206+
description: >-
1207+
Log version
12041208
- name: lowcount
12051209
type: long
12061210
description: >-

‎packages/fortinet_fortiproxy/docs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -546,6 +546,7 @@ An example event for `log` looks as following:
546546
| fortinet.proxy.locport | Local Port | long |
547547
| fortinet.proxy.log | Log Name for Log Rotation | keyword |
548548
| fortinet.proxy.login | SSH login Name | keyword |
549+
| fortinet.proxy.logver | Log version | long |
549550
| fortinet.proxy.lowcount | Security Rating result failed count for low severity | long |
550551
| fortinet.proxy.mac | MAC Address | keyword |
551552
| fortinet.proxy.masterdstmac | Destination master MAC address | keyword |

‎packages/fortinet_fortiproxy/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.1.3
22
name: fortinet_fortiproxy
33
title: "Fortinet FortiProxy"
4-
version: "1.2.2"
4+
version: "1.2.3"
55
description: "Collect logs from Fortinet FortiProxy with Elastic Agent."
66
type: integration
77
categories:

0 commit comments

Comments
 (0)