[Enhancement] [Cisco ISE] Make enhancement in connector with best practices implementation #4694

vinit-chauhan · 2022-11-22T12:50:17Z

Type of change

Enhancement

What does this PR do?

Make enhancement in Cisco ISE connector with listed best practices.

Sr. No.	Best Practices
1	Verify best practices test cases are executed
2	Verify all automated tests
3	Verify default values of port for TCP, UDP or HTTP Endpoint Input
4	Verify that the data is ingested in kibana for in interval
5	Verify all fields are correctly mapped for all Data streams
6	Verify related.ip field in datastream
7	Verify related.hosts field in datastream
8	Verify related.user field in datastream
9	Verify network.protocol is in lowercase form
10	Verify log.level is in lowercase form
11	Verify very long syslog message
12	Verify MAC address should be separated by dash and value should be an array and MAC address should be valid. MAC address is in uppercase form
13	Verify format of title of visualizations
14	Verify format of title of dashboard
15	Verify Datastream Dashboard
16	Verify filters in visualizations
17	Verify visualizations in different browser
18	Verify README file

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/cisco_ise directory.
Run the following command to run tests.

elastic-package test

Related issues

Relates Make enhancement in connectors with best practices implementation #4535

Screenshots

…r to the convert and date processors

elasticmachine · 2022-11-22T12:55:25Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

elasticmachine · 2022-11-22T13:06:40Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2022-11-22T13:06:52Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-11-28T11:51:43.277+0000
Duration: 16 min 1 sec

Test stats 🧪

Test	Results
Failed	0
Passed	37
Skipped	0
Total	37

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

elasticmachine · 2022-11-22T13:07:00Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`1/1`)	💚
Files	100.0% (`17/17`)	💚
Classes	100.0% (`17/17`)	💚
Methods	100.0% (`176/176`)	💚 1.961
Lines	99.003% (`4566/4612`)	👍 3.217
Conditionals	100.0% (`0/0`)	💚

P1llus

Some great enhancements here, some small nitpicks, mostly the same thing over and over again that might need to change a bit.

packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-guest.log-expected.json

P1llus · 2022-11-25T13:25:05Z

packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/default.yml

+  - trim:
+      field: event.original
+      ignore_failure: true


Event original fields should never have any changes done to it, it should always be the raw field, please remove the processor.

P1llus · 2022-11-25T13:27:54Z

...e/data_stream/log/elasticsearch/ingest_pipeline/pipeline_authentication_flow_diagnostics.yml

-        ctx.event.category = eventCategory;
+  - grok:
+      field: cisco_ise.log.message.description
+      if: ctx.cisco_ise?.log?.message?.description != null && ctx.cisco_ise.log.message.description != ''


Why does this have to be grok? Can we not simply rename description to event.action if the field is not null?

Hi @P1llus, There are two sections of the message, that are separated by a colon. We have extracted only the value before the colon in the message, as the first section of the message gives a high-level overview of the action performed. Moreover, the message can be very long and we don't think keeping the whole message as event.action is appropriate. Therefore, we opted to extract only the part before the : to be the event.action.
ex: message --> "Administrator-Login: Administrator authentication succeeded" and event.action --> "administrator-login"

P1llus · 2022-11-25T13:28:07Z

packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/pipeline_failed_attempts.yml

+            field: error.message
+            value: '{{{_ingest.on_failure_message}}}'
+  - grok:
+      field: cisco_ise.log.message.description


P1llus · 2022-11-25T13:28:48Z

...o_ise/data_stream/log/elasticsearch/ingest_pipeline/pipeline_identity_stores_diagnostics.yml

+            value: '{{{_ingest.on_failure_message}}}'
+  - grok:
+      field: cisco_ise.log.message.description
+      if: ctx.cisco_ise?.log?.message?.description != null && ctx.cisco_ise.log.message.description != ''


P1llus · 2022-11-25T13:30:45Z

packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/pipeline_radius_accounting.yml

-        ctx.event.action = ctx?.cisco_ise?.log?.message?.description?.splitOnToken(":")[0]?.toLowerCase();
+  - grok:
+      field: cisco_ise.log.message.description
+      if: ctx.cisco_ise?.log?.message?.description != null && ctx.cisco_ise.log.message.description != ''


P1llus · 2022-11-25T13:31:19Z

...ages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/pipeline_radius_diagnostics.yml

      field: cisco_ise.log.message.description
-      value: "RADIUS: An Access-Request MUST contain at least a NAS-IP-Address NAS-IPv6-Address, or a NAS-Identifier; Continue processing"
-      if: ctx?.cisco_ise?.log?.message?.code == "11015"  
+      value: 'RADIUS: An Access-Request MUST contain at least a NAS-IP-Address NAS-IPv6-Address, or a NAS-Identifier; Continue processing'


Why would we need to set the description manually here?

We manually set the message for this specific message code, "11015," because it has multiple commas: "RADIUS: An Access-Request MUST contain at least a NAS-IP-Address, NAS-IPv6-Address, or a NAS-Identifier; Continue processing." If we do not set it manually, it will result in an inappropriate mapping in the KV processor, because in all the other messages, we get an end of the message with " ," . Moreover, we split the message using it. Therefore, we skip that message in the grok and manually set the value of the message field.

P1llus · 2022-11-25T13:31:28Z

...ages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/pipeline_radius_diagnostics.yml

+  - grok:
+      field: cisco_ise.log.message.description
+      if: ctx.cisco_ise?.log?.message?.description != null && ctx.cisco_ise.log.message.description != ''
+      patterns:


P1llus · 2022-11-25T13:32:06Z

...ages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/pipeline_threat_centric_nac.yml

+  - grok:
+      field: cisco_ise.log.message.description
+      if: ctx.cisco_ise?.log?.message?.description != null && ctx.cisco_ise.log.message.description != ''
+      patterns:


P1llus · 2022-11-25T13:33:30Z

packages/cisco_ise/manifest.yml

  - name: Cisco ISE
    title: Cisco_ISE logs
-    description: Collect cisco_ise logs
+    description: Collect cisco_ise logs.


Should be Collect Cisco ISE logs.

elasticmachine · 2022-11-29T17:25:53Z

Package cisco_ise - 1.4.0 containing this change is available at https://epr.elastic.co/search?package=cisco_ise

Update Aggregation visualizations to Lens, Add an on_failure processo…

baf1394

…r to the convert and date processors

vinit-chauhan requested a review from a team as a code owner November 22, 2022 12:50

Update changelog entry

7cfa3be

vinit-chauhan added enhancement New feature or request Team:Security-External Integrations Integration:cisco_ise Cisco ISE labels Nov 22, 2022

P1llus reviewed Nov 25, 2022

View reviewed changes

Changes as per review comments

4949feb

vinit-chauhan requested a review from P1llus November 29, 2022 10:23

P1llus approved these changes Nov 29, 2022

View reviewed changes

P1llus merged commit 41f06b7 into elastic:main Nov 29, 2022

[Enhancement] [Cisco ISE] Make enhancement in connector with best practices implementation #4694

[Enhancement] [Cisco ISE] Make enhancement in connector with best practices implementation #4694

Uh oh!

Conversation

vinit-chauhan commented Nov 22, 2022

What does this PR do?

Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elasticmachine commented Nov 22, 2022

Uh oh!

elasticmachine commented Nov 22, 2022

🚀 Benchmarks report

Uh oh!

elasticmachine commented Nov 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

Uh oh!

elasticmachine commented Nov 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌐 Coverage report

Uh oh!

P1llus left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Nov 29, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

elasticmachine commented Nov 22, 2022 •

edited

Loading

elasticmachine commented Nov 22, 2022 •

edited

Loading