Proposed commit message
Added new data streamactivity to collectActivity logs from Cisco Duo.
The CEL program follows the API specifications set at:
It also adds a feature request for theauth data stream, including geo enrichment for the IP into theaccess_device field.
Checklist
How to test this PR locally
Added pipeline and system tests for the new data stream:
Run asset tests for the package--- Test results for package: cisco_duo - START ---╭───────────┬────────────────────┬───────────┬────────────────────────────────────────────────────────────────────┬────────┬──────────────╮│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │├───────────┼────────────────────┼───────────┼────────────────────────────────────────────────────────────────────┼────────┼──────────────┤│ cisco_duo │ │ asset │ dashboard cisco_duo-0607d4a3-5322-41c1-b8fa-f0d29bcc2757 is loaded │ PASS │ 1.584µs ││ cisco_duo │ │ asset │ dashboard cisco_duo-118061c3-3130-4c71-8899-157bab1ad447 is loaded │ PASS │ 292ns ││ cisco_duo │ │ asset │ dashboard cisco_duo-5a0b80af-49ad-42ee-89b7-c89faa927826 is loaded │ PASS │ 416ns ││ cisco_duo │ │ asset │ dashboard cisco_duo-7a135061-78a3-45d9-951b-4b9b665fa729 is loaded │ PASS │ 208ns ││ cisco_duo │ │ asset │ dashboard cisco_duo-b386f94c-0856-4508-ba08-a525a2f3b70f is loaded │ PASS │ 417ns ││ cisco_duo │ │ asset │ dashboard cisco_duo-c3336a66-68ff-4bcd-95ff-fb388793f721 is loaded │ PASS │ 375ns ││ cisco_duo │ │ asset │ dashboard cisco_duo-e91470e5-2ded-4ff1-8bb5-24e06b949c1d is loaded │ PASS │ 250ns ││ cisco_duo │ │ asset │ map cisco_duo-158c0e80-148c-11ec-9386-31989719f9db is loaded │ PASS │ 250ns ││ cisco_duo │ │ asset │ search cisco_duo-64869c89-8c44-4644-a84a-9815c0fddba0 is loaded │ PASS │ 375ns ││ cisco_duo │ activity │ asset │ index_template logs-cisco_duo.activity is loaded │ PASS │ 250ns ││ cisco_duo │ activity │ asset │ ingest_pipeline logs-cisco_duo.activity-2.2.0 is loaded │ PASS │ 292ns ││ cisco_duo │ admin │ asset │ index_template logs-cisco_duo.admin is loaded │ PASS │ 166ns ││ cisco_duo │ admin │ asset │ ingest_pipeline logs-cisco_duo.admin-2.2.0 is loaded │ PASS │ 292ns ││ cisco_duo │ auth │ asset │ index_template logs-cisco_duo.auth is loaded │ PASS │ 334ns ││ cisco_duo │ auth │ asset │ ingest_pipeline logs-cisco_duo.auth-2.2.0 is loaded │ PASS │ 125ns ││ cisco_duo │ offline_enrollment │ asset │ index_template logs-cisco_duo.offline_enrollment is loaded │ PASS │ 209ns ││ cisco_duo │ offline_enrollment │ asset │ ingest_pipeline logs-cisco_duo.offline_enrollment-2.2.0 is loaded │ PASS │ 125ns ││ cisco_duo │ summary │ asset │ index_template logs-cisco_duo.summary is loaded │ PASS │ 208ns ││ cisco_duo │ summary │ asset │ ingest_pipeline logs-cisco_duo.summary-2.2.0 is loaded │ PASS │ 125ns ││ cisco_duo │ telephony │ asset │ index_template logs-cisco_duo.telephony is loaded │ PASS │ 209ns ││ cisco_duo │ telephony │ asset │ ingest_pipeline logs-cisco_duo.telephony-2.2.0 is loaded │ PASS │ 125ns ││ cisco_duo │ telephony_v2 │ asset │ index_template logs-cisco_duo.telephony_v2 is loaded │ PASS │ 375ns ││ cisco_duo │ telephony_v2 │ asset │ ingest_pipeline logs-cisco_duo.telephony_v2-2.2.0 is loaded │ PASS │ 166ns ││ cisco_duo │ trust_monitor │ asset │ index_template logs-cisco_duo.trust_monitor is loaded │ PASS │ 375ns ││ cisco_duo │ trust_monitor │ asset │ ingest_pipeline logs-cisco_duo.trust_monitor-2.2.0 is loaded │ PASS │ 125ns │╰───────────┴────────────────────┴───────────┴────────────────────────────────────────────────────────────────────┴────────┴──────────────╯--- Test results for package: cisco_duo - END ---DoneRun pipeline tests for the package--- Test results for package: cisco_duo - START ---╭───────────┬────────────────────┬───────────┬────────────────────────────────────────────────────────┬────────┬──────────────╮│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │├───────────┼────────────────────┼───────────┼────────────────────────────────────────────────────────┼────────┼──────────────┤│ cisco_duo │ activity │ pipeline │ (ingest pipeline warnings test-activity.log) │ PASS │ 196.669625ms ││ cisco_duo │ activity │ pipeline │ test-activity.log │ PASS │ 134.559833ms ││ cisco_duo │ admin │ pipeline │ (ingest pipeline warnings test-admin.log) │ PASS │ 206.523291ms ││ cisco_duo │ admin │ pipeline │ (ingest pipeline warnings test-empty.log) │ PASS │ 202.109375ms ││ cisco_duo │ admin │ pipeline │ test-admin.log │ PASS │ 151.045ms ││ cisco_duo │ admin │ pipeline │ test-empty.log │ PASS │ 40.457458ms ││ cisco_duo │ auth │ pipeline │ (ingest pipeline warnings test-auth.log) │ PASS │ 218.412834ms ││ cisco_duo │ auth │ pipeline │ (ingest pipeline warnings test-empty.log) │ PASS │ 194.9385ms ││ cisco_duo │ auth │ pipeline │ test-auth.log │ PASS │ 345.084917ms ││ cisco_duo │ auth │ pipeline │ test-empty.log │ PASS │ 40.33725ms ││ cisco_duo │ offline_enrollment │ pipeline │ (ingest pipeline warnings test-empty.log) │ PASS │ 198.41075ms ││ cisco_duo │ offline_enrollment │ pipeline │ (ingest pipeline warnings test-offline-enrollment.log) │ PASS │ 200.7585ms ││ cisco_duo │ offline_enrollment │ pipeline │ test-empty.log │ PASS │ 37.008042ms ││ cisco_duo │ offline_enrollment │ pipeline │ test-offline-enrollment.log │ PASS │ 44.096708ms ││ cisco_duo │ summary │ pipeline │ (ingest pipeline warnings test-summary.log) │ PASS │ 205.246834ms ││ cisco_duo │ summary │ pipeline │ test-summary.log │ PASS │ 41.75075ms ││ cisco_duo │ telephony │ pipeline │ (ingest pipeline warnings test-empty.log) │ PASS │ 234.215875ms ││ cisco_duo │ telephony │ pipeline │ (ingest pipeline warnings test-telephony.log) │ PASS │ 247.474375ms ││ cisco_duo │ telephony │ pipeline │ test-empty.log │ PASS │ 40.395042ms ││ cisco_duo │ telephony │ pipeline │ test-telephony.log │ PASS │ 38.864542ms ││ cisco_duo │ telephony_v2 │ pipeline │ (ingest pipeline warnings test-telephony-v2.log) │ PASS │ 210.205625ms ││ cisco_duo │ telephony_v2 │ pipeline │ test-telephony-v2.log │ PASS │ 43.08375ms ││ cisco_duo │ trust_monitor │ pipeline │ (ingest pipeline warnings test-trust-monitor.log) │ PASS │ 204.730667ms ││ cisco_duo │ trust_monitor │ pipeline │ test-trust-monitor.log │ PASS │ 49.444791ms │╰───────────┴────────────────────┴───────────┴────────────────────────────────────────────────────────┴────────┴──────────────╯--- Test results for package: cisco_duo - END ---DoneRun policy tests for the package--- Test results for package: cisco_duo - START ---No test results--- Test results for package: cisco_duo - END ---DoneRun static tests for the package--- Test results for package: cisco_duo - START ---╭───────────┬────────────────────┬───────────┬──────────────────────────┬────────┬──────────────╮│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │├───────────┼────────────────────┼───────────┼──────────────────────────┼────────┼──────────────┤│ cisco_duo │ activity │ static │ Verify sample_event.json │ PASS │ 52.114292ms ││ cisco_duo │ admin │ static │ Verify sample_event.json │ PASS │ 41.618833ms ││ cisco_duo │ auth │ static │ Verify sample_event.json │ PASS │ 57.805375ms ││ cisco_duo │ offline_enrollment │ static │ Verify sample_event.json │ PASS │ 42.232042ms ││ cisco_duo │ summary │ static │ Verify sample_event.json │ PASS │ 38.962625ms ││ cisco_duo │ telephony │ static │ Verify sample_event.json │ PASS │ 38.040167ms ││ cisco_duo │ telephony_v2 │ static │ Verify sample_event.json │ PASS │ 37.535666ms ││ cisco_duo │ trust_monitor │ static │ Verify sample_event.json │ PASS │ 42.190791ms │╰───────────┴────────────────────┴───────────┴──────────────────────────┴────────┴──────────────╯--- Test results for package: cisco_duo - END ---DoneRun system tests for the package--- Test results for package: cisco_duo - START ---╭───────────┬────────────────────┬───────────┬───────────┬────────┬───────────────╮│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │├───────────┼────────────────────┼───────────┼───────────┼────────┼───────────────┤│ cisco_duo │ activity │ system │ default │ PASS │ 36.870015625s ││ cisco_duo │ admin │ system │ default │ PASS │ 33.85713475s ││ cisco_duo │ auth │ system │ default │ PASS │ 33.772624833s ││ cisco_duo │ offline_enrollment │ system │ default │ PASS │ 38.540788792s ││ cisco_duo │ summary │ system │ default │ PASS │ 34.455289708s ││ cisco_duo │ telephony │ system │ default │ PASS │ 33.41083725s ││ cisco_duo │ telephony_v2 │ system │ default │ PASS │ 39.567072958s ││ cisco_duo │ trust_monitor │ system │ default │ PASS │ 39.527218083s │╰───────────┴────────────────────┴───────────┴───────────┴────────┴───────────────╯--- Test results for package: cisco_duo - END ---Done
Related issues
Screenshots
Data stream configuration
Dashboard
efd6 left a comment
Uh oh!
There was an error while loading.Please reload this page.
Proposed commit message
Added new data stream
activityto collectActivity logs from Cisco Duo.The CEL program follows the API specifications set at:
It also adds a feature request for the
authdata stream, including geo enrichment for the IP into theaccess_devicefield.Checklist
changelog.ymlfile.How to test this PR locally
Added pipeline and system tests for the new data stream:
Related issues
Screenshots
Data stream configuration
Dashboard