[fortinet_fortimanager] Add more ECS fields mappings

[aleksmaus]

Proposed commit message

Add more ECS fields mappings.

The following mappings were requested to be added in the original issue

srcip --> source.ip
srcname --> source.domain
srcport --> source.port
dstip --> destination.ip
dstname --> destination.domain
dstcountry --> destination.geo.country_name
unauthuser --> user.name
sentbyte --> source.bytes
rcvdbyte --> destination.bytes
osname --> os.name
direction --> network.direction
crlevel --> risk.static_level
crscore --> risk.static_score_norm
apprisk --> event.risk_score
appcat --> event.category

The following fields mapping changed during this PR review:

appcat --> rule.category
srcname --> source.address
dstname --> destination.address

The following fields are not mapped with this PR still, because it is unclear how to map them yet, based on the examples of logs that we received. For example:

It's not clear at the moment how to map apprisk to event.risk_score values.
[3] parsing field value failed: field "event.risk_score"'s Go type, string, does not match the expected field type: float (field value: elevated)

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[taylor-swanson]

The appcat value from the actual logs doesn't quite match the expectations for ECS event.category

Even if you normalized those values into an array, the bigger issue is that event.category only has a limited set of allowed values. In this case, event.category nor event.risk_score are not good fits here. For reference, fortinet_fortigate moves appcat into rule.category.

[aleksmaus]

or reference, fortinet_fortigate moves appcat into rule.category.

we could do the same for this integration

[aleksmaus]

or reference, fortinet_fortigate moves appcat into rule.category.

we could do the same for this integration

or leave as is.

please cast your ballots

[taylor-swanson]

I would say align with fortigate (as seen here).

[aleksmaus]

I would say align with fortigate (as seen here).

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[taylor-swanson]

I think srcname and dstname should move to source.address/destination.address, since looking at the example logs, we see instances of both an IP address and a hostname in there.

The *.address fields say this in ECS:

Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field.
Then it should be duplicated to .ip or .domain, depending on which one it is.

I've used the convert processor (with type ip) to figure out if the value should end up in .ip or .domain.

I really wish a processor could this automatically for us...

Other changes LGTM.

[taylor-swanson]

I was about to say you can just add this handler down at the bottom of the pipeline and not have to add it to every processor that is expected to fail, but I see you are just following the style used in the rest pipeline (one that I don't agree with, but that's a separate issue).

No changes need to be made here.

[aleksmaus]

I think srcname and dstname should move to source.address/destination.address, since looking at the example logs, we see instances of both an IP address and a hostname in there.

Updated

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 7120f7f

History

• 💚 Build #16374 succeeded 766c40c
• 💚 Build #16371 succeeded 306a0fe

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
92.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package fortinet_fortimanager - 2.13.0 containing this change is available at https://epr.elastic.co/search?package=fortinet_fortimanager