Skip to content

Commit 03681bb

Browse files
JocLRojasJocLRojas
authored
Update filters: GCP, Sophos XG, Windows (#2175)
* feat(filters/gcp): add Cloud Audit Logs (protoPayload) support * fix(filters/sophos-xg): guard renames and actionResult against missing fields * chore(filters/windows): rename log.data.SubStatus field * fix(filters/sophos-xg): correct operator precedence in actionResult guard
1 parent e67fc13 commit 03681bb

3 files changed

Lines changed: 130 additions & 4 deletions

File tree

‎filters/google/gcp.yml‎

Lines changed: 105 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1-
# GCP filter, version 2.1.2
2-
#
1+
# GCP filter, version 2.2.0
2+
#
33
# Documentations
44
# 1- https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry
5+
# 2- https://cloud.google.com/logging/docs/audit (protoPayload / AuditLog)
56

67
pipeline:
78
- dataTypes:
@@ -251,6 +252,75 @@ pipeline:
251252
- log.resource.type
252253
to: log.resourceType
253254

255+
# .......................................................................#
256+
# Renaming protoPayload fields (Cloud Audit Logs — AuditLog message)
257+
# .......................................................................#
258+
# NOTE: log.protoPayload.@type is NOT renamed here. The engine treats
259+
# paths containing '@' as complex and the rename plugin errors with
260+
# "cannot delete value from a complex path". The whole log.protoPayload
261+
# subtree is dropped in the final delete step, so the field is cleaned
262+
# up implicitly. We use log.protoPayloadMethodName (always present in
263+
# AuditLog) as the discriminator for protoPayload-derived actionResult.
264+
- rename:
265+
from:
266+
- log.protoPayload.authenticationInfo.principalEmail
267+
to: origin.user
268+
269+
- rename:
270+
from:
271+
- log.protoPayload.authenticationInfo.principalSubject
272+
to: log.protoPayloadPrincipalSubject
273+
274+
- rename:
275+
from:
276+
- log.protoPayload.authenticationInfo.oauthInfo.oauthClientId
277+
to: log.protoPayloadOauthClientId
278+
279+
- rename:
280+
from:
281+
- log.protoPayload.requestMetadata.callerIp
282+
to: origin.ip
283+
284+
- rename:
285+
from:
286+
- log.protoPayload.requestMetadata.callerSuppliedUserAgent
287+
to: log.httpUserAgent
288+
289+
- rename:
290+
from:
291+
- log.protoPayload.methodName
292+
to: log.protoPayloadMethodName
293+
294+
- rename:
295+
from:
296+
- log.protoPayload.serviceName
297+
to: log.protoPayloadServiceName
298+
299+
- rename:
300+
from:
301+
- log.protoPayload.resourceName
302+
to: log.protoPayloadResourceName
303+
304+
- rename:
305+
from:
306+
- log.protoPayload.resourceLocation.currentLocations
307+
to: log.protoPayloadResourceLocation
308+
309+
- rename:
310+
from:
311+
- log.protoPayload.authorizationInfo
312+
to: log.protoPayloadAuthorizationInfo
313+
314+
- rename:
315+
from:
316+
- log.protoPayload.status.code
317+
to: log.protoPayloadStatusCode
318+
319+
- rename:
320+
from:
321+
- log.protoPayload.status.message
322+
to: log.protoPayloadStatusMessage
323+
254324
# .......................................................................#
255325
# Renaming operation field
256326
# .......................................................................#
@@ -303,6 +373,11 @@ pipeline:
303373
- statusCode
304374
to: int
305375

376+
- cast:
377+
fields:
378+
- log.protoPayloadStatusCode
379+
to: int
380+
306381
# Adding severity field based on log.severity
307382
- add:
308383
function: "string"
@@ -383,6 +458,34 @@ pipeline:
383458
value: "denied"
384459
where: equals("log.jsonPayloadEnforcedEdgeSecurityPolicyOutcome", "DENY")
385460

461+
# Adding actionResult for Cloud Audit Logs (protoPayload):
462+
# In GCP AuditLog, status.code follows google.rpc.Code — 0/absent = OK,
463+
# any non-zero code = error. We only apply this when the event is an
464+
# AuditLog (log.protoPayloadMethodName is always present in AuditLog;
465+
# used as discriminator since log.protoPayload.@type can't be renamed
466+
# due to the '@' character) so non-audit logs keep their existing
467+
# actionResult derivation.
468+
- add:
469+
function: "string"
470+
params:
471+
key: actionResult
472+
value: "success"
473+
where: 'exists("log.protoPayloadMethodName") && !exists("log.protoPayloadStatusCode")'
474+
475+
- add:
476+
function: "string"
477+
params:
478+
key: actionResult
479+
value: "success"
480+
where: 'exists("log.protoPayloadMethodName") && equals("log.protoPayloadStatusCode", 0)'
481+
482+
- add:
483+
function: "string"
484+
params:
485+
key: actionResult
486+
value: "failure"
487+
where: 'exists("log.protoPayloadMethodName") && greaterThan("log.protoPayloadStatusCode", 0)'
488+
386489
# Adding geolocation to origin.ip
387490
- dynamic:
388491
plugin: com.utmstack.geolocation

‎filters/sophos/sophos_xg_firewall.yml‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Sophos_XG filter, version 3.0.5
1+
# Sophos_XG filter, version 3.0.6
22
# Supports SF 20.0 version log types
33
# See manual: https://docs.sophos.com/nsg/sophos-firewall/20.0/pdf/sf-syslog-guide-20.0.pdf
44
# and documentation https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/TroubleshootingLogs/LogFileDetails/index.html#https-ftp-waf
@@ -318,6 +318,7 @@ pipeline:
318318
from:
319319
- log.statuscode
320320
to: log.statusCode
321+
where: exists("log.statuscode")
321322

322323
- rename:
323324
from:
@@ -682,11 +683,27 @@ pipeline:
682683
- origin.bytesSent
683684
to: float
684685

686+
# Adding actionResult based on log.subtype value
687+
- add:
688+
function: 'string'
689+
params:
690+
key: actionResult
691+
value: 'denied'
692+
where: exists("log.subType") && equals("log.subType", "Denied")
693+
694+
- add:
695+
function: 'string'
696+
params:
697+
key: actionResult
698+
value: 'accepted'
699+
where: exists("log.subType") && equals("log.subType", "Accepted") || equals("log.subType", "Allowed")
700+
685701
# Renaming "log.statusCode" to "statusCode" to add it to the event structure
686702
- rename:
687703
from:
688704
- log.statusCode
689705
to: statusCode
706+
where: exists("log.statusCode")
690707

691708
# Adding actionResult
692709
# denied by default
@@ -695,13 +712,14 @@ pipeline:
695712
params:
696713
key: actionResult
697714
value: 'denied'
715+
where: exists("statusCode")
698716

699717
- add:
700718
function: 'string'
701719
params:
702720
key: actionResult
703721
value: 'accepted'
704-
where: (greaterOrEqual("statusCode", 200) && lessOrEqual("statusCode", 299)) || (greaterOrEqual("statusCode", 300) && lessOrEqual("statusCode", 399) && greaterThan("origin.bytesReceived", 0))
722+
where: exists("statusCode") && ((greaterOrEqual("statusCode", 200) && lessOrEqual("statusCode", 299)) || (greaterOrEqual("statusCode", 300) && lessOrEqual("statusCode", 399) && greaterThan("origin.bytesReceived", 0)))
705723

706724
# Removing unused fields
707725
- delete:

‎filters/windows/windows-events.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ pipeline:
4545
- log.data.SubjectUserSid
4646
to: log.eventDataSubjectUserSid
4747

48+
- rename:
49+
from:
50+
- log.data.SubStatus
51+
to: log.eventDataSubStatus
52+
4853
- rename:
4954
from:
5055
- log.data.PrivilegeList

0 commit comments

Comments
 (0)