Skip to content

Commit c418d7c

Browse files
shubhamvekariya-crestshubhamvekariya-crest
committed
Resolve CI Failures
1 parent d61fadd commit c418d7c

File tree

2 files changed

+142
-31
lines changed

2 files changed

+142
-31
lines changed

cato_networks/assets/logs/cato_networks.yaml renamed to cato_networks/assets/logs/cato-networks.yaml

Lines changed: 81 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,50 @@ metric_id: cato-networks
33
backend_only: false
44
facets:
55
- groups:
6-
- User
7-
name: User ID
8-
path: usr.id
9-
source: log
10-
- groups:
11-
- User
12-
name: User Name
13-
path: usr.name
6+
- DNS
7+
name: Question Name
8+
path: dns.question.name
149
source: log
1510
- groups:
1611
- Event
1712
name: Event Name
1813
path: evt.name
1914
source: log
15+
- groups:
16+
- Geoip
17+
name: City Name
18+
path: network.client.geoip.city.name
19+
source: log
20+
- groups:
21+
- Geoip
22+
name: Continent Code
23+
path: network.client.geoip.continent.code
24+
source: log
25+
- groups:
26+
- Geoip
27+
name: Continent Name
28+
path: network.client.geoip.continent.name
29+
source: log
30+
- groups:
31+
- Geoip
32+
name: Country ISO Code
33+
path: network.client.geoip.country.iso_code
34+
source: log
35+
- groups:
36+
- Geoip
37+
name: Country Name
38+
path: network.client.geoip.country.name
39+
source: log
40+
- groups:
41+
- Geoip
42+
name: Subdivision ISO Code
43+
path: network.client.geoip.subdivision.iso_code
44+
source: log
45+
- groups:
46+
- Geoip
47+
name: Subdivision Name
48+
path: network.client.geoip.subdivision.name
49+
source: log
2050
- groups:
2151
- Web Access
2252
name: Client IP
@@ -27,6 +57,41 @@ facets:
2757
name: Client Port
2858
path: network.client.port
2959
source: log
60+
- groups:
61+
- Geoip
62+
name: Destination City Name
63+
path: network.destination.geoip.city.name
64+
source: log
65+
- groups:
66+
- Geoip
67+
name: Destination Continent Code
68+
path: network.destination.geoip.continent.code
69+
source: log
70+
- groups:
71+
- Geoip
72+
name: Destination Continent Name
73+
path: network.destination.geoip.continent.name
74+
source: log
75+
- groups:
76+
- Geoip
77+
name: Destination Country ISO Code
78+
path: network.destination.geoip.country.iso_code
79+
source: log
80+
- groups:
81+
- Geoip
82+
name: Destination Country Name
83+
path: network.destination.geoip.country.name
84+
source: log
85+
- groups:
86+
- Geoip
87+
name: Destination Subdivision ISO Code
88+
path: network.destination.geoip.subdivision.iso_code
89+
source: log
90+
- groups:
91+
- Geoip
92+
name: Destination Subdivision Name
93+
path: network.destination.geoip.subdivision.name
94+
source: log
3095
- groups:
3196
- Web Access
3297
name: Destination IP
@@ -43,9 +108,14 @@ facets:
43108
path: usr.email
44109
source: log
45110
- groups:
46-
- DNS
47-
name: Question Name
48-
path: dns.question.name
111+
- User
112+
name: User ID
113+
path: usr.id
114+
source: log
115+
- groups:
116+
- User
117+
name: User Name
118+
path: usr.name
49119
source: log
50120
pipeline:
51121
type: pipeline

cato_networks/assets/logs/cato_networks_tests.yaml renamed to cato_networks/assets/logs/cato-networks_tests.yaml

Lines changed: 61 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,6 @@ tests:
2828
custom:
2929
fieldsMap:
3030
account_id: "20123123"
31-
admin: "CATO-IN1-APAC-PTNR-ITPL User #123"
32-
admin_id: "400000123"
3331
change:
3432
After:
3533
blockNewDomains: "false"
@@ -42,6 +40,9 @@ tests:
4240
model_name: "IpsConfiguration"
4341
model_type: "IPS Configuration"
4442
module: "IPS Configuration"
43+
usr:
44+
id: "400000123"
45+
name: "CATO-IN1-APAC-PTNR-ITPL User #123"
4546
message: |-
4647
{
4748
"fieldsMap" : {
@@ -64,8 +65,10 @@ tests:
6465
"insertion_date" : "1763455630734"
6566
}
6667
}
68+
service: "audit-logs"
6769
tags:
6870
- "source:LOGS_SOURCE"
71+
timestamp: 1763455630734
6972
-
7073
sample: |-
7174
{
@@ -95,8 +98,6 @@ tests:
9598
custom:
9699
fieldsMap:
97100
account_id: "20000232"
98-
admin: "CATO-IN1-APAC-PTNR-ITPL User #123"
99-
admin_id: "400000123"
100101
change:
101102
After:
102103
action: "BLOCK"
@@ -110,6 +111,9 @@ tests:
110111
model_name: "WAN Traffic"
111112
model_type: "Antivirus Rule"
112113
module: "Threat Protection Rule"
114+
usr:
115+
id: "400000123"
116+
name: "CATO-IN1-APAC-PTNR-ITPL User #123"
113117
message: |-
114118
{
115119
"fieldsMap" : {
@@ -133,8 +137,10 @@ tests:
133137
"insertion_date" : "1763455630734"
134138
}
135139
}
140+
service: "audit-logs"
136141
tags:
137142
- "source:LOGS_SOURCE"
143+
timestamp: 1763455630734
138144
-
139145
sample: |-
140146
{
@@ -172,15 +178,20 @@ tests:
172178
event_count: 1
173179
event_id: "c8d2456ef8b48123"
174180
event_message: "ApiKey login successfully"
181+
event_status: "info"
175182
event_sub_type: "ApiKey"
176-
event_type: "Connectivity"
183+
evt:
184+
name: "Connectivity"
177185
internalId: "c8d2456ef8b48123"
178186
internal_id: "c8d2456ef8b48123"
179187
key_name: "demo-key"
180188
login_type: "API"
189+
network:
190+
client:
191+
geoip: {}
192+
ip: "10.10.10.10"
181193
src_country: "India"
182194
src_country_code: "IN"
183-
src_ip: "10.10.10.10"
184195
src_is_site_or_vpn: "API"
185196
time: 1763478148991
186197
time_str: "2025-11-18T15:02:28Z"
@@ -208,8 +219,11 @@ tests:
208219
"time" : 1763478148991,
209220
"event_message" : "ApiKey login successfully"
210221
}
222+
service: "events"
223+
status: "info"
211224
tags:
212225
- "source:LOGS_SOURCE"
226+
timestamp: 1763478148991
213227
-
214228
sample: |-
215229
{
@@ -254,16 +268,21 @@ tests:
254268
device_name: "DESKTOP-ENI0ABC"
255269
event_count: 1
256270
event_id: "c14b9006b130b123"
271+
event_status: "info"
257272
event_sub_type: "XDR Threat"
258-
event_type: "Detection and Response"
273+
evt:
274+
name: "Detection and Response"
259275
indication: "Cybersquatting Malicious Activity"
260276
internalId: "c14b9006b130bd27"
261277
internal_id: "c14b9006b130b123"
278+
network:
279+
client:
280+
geoip: {}
281+
ip: "10.10.10.10"
262282
producer: "Threat Prevention"
263283
raw_data: ""
264284
rule_id: "691d9f390a267b749814b123"
265285
rule_name: "Test"
266-
src_ip: "10.10.10.10"
267286
src_is_site_or_vpn: "SDP User"
268287
src_site_id: 2
269288
src_site_name: "John Doe"
@@ -272,9 +291,10 @@ tests:
272291
time: 1763568228849
273292
time_str: "2025-11-19T16:03:48Z"
274293
trigger: "Story Created"
275-
user_id: 2
294+
usr:
295+
email: "test@example.com"
296+
id: 2
276297
vendor: "Cato"
277-
vpn_user_email: "test@example.com"
278298
message: |-
279299
{
280300
"event_count" : 1,
@@ -307,8 +327,11 @@ tests:
307327
"indication" : "Cybersquatting Malicious Activity",
308328
"status" : "Open"
309329
}
330+
service: "events"
331+
status: "info"
310332
tags:
311333
- "source:LOGS_SOURCE"
334+
timestamp: 1763568228849
312335
-
313336
sample: |-
314337
{
@@ -394,19 +417,30 @@ tests:
394417
- 400000307
395418
dest_country: "India"
396419
dest_country_code: "IN"
397-
dest_ip: "10.10.10.10"
398-
dest_port: 443
399420
device_name: "AssetTag-EID"
400-
domain_name: "signaler-pa.clients6.google.com"
421+
dns:
422+
question:
423+
name: "signaler-pa.clients6.google.com"
401424
event_count: 1
402425
event_id: "e278205a1f4c73"
426+
event_status: "info"
403427
event_sub_type: "Internet Firewall"
404-
event_type: "Security"
428+
evt:
429+
name: "Security"
405430
host_ip: "10.10.10.10"
406431
host_mac: "aa:aa:83:20:60:ab"
407432
internalId: "e278205a1f4c73"
408433
internal_id: "e278205a1f4c73"
409434
ip_protocol: "UDP"
435+
network:
436+
client:
437+
geoip: {}
438+
ip: "10.10.10.10"
439+
port: 65222
440+
destination:
441+
geoip: {}
442+
ip: "10.10.10.10"
443+
port: 443
410444
network_rule: "Internet Traffic - Predefined"
411445
os_type: "OS_WINDOWS"
412446
os_version: "11"
@@ -416,21 +450,20 @@ tests:
416450
rule_name: "Block QUIC services"
417451
src_country: "India"
418452
src_country_code: "IN"
419-
src_ip: "10.10.10.10"
420453
src_is_site_or_vpn: "SDP User"
421454
src_isp_ip: "10.10.10.10"
422-
src_port: 65222
423455
src_site_id: 0
424456
src_site_name: "John Doe"
425457
static_host: false
426458
time: 1763473282069
427459
time_str: "2025-11-18T13:41:22Z"
428460
traffic_direction: "OUTBOUND"
429-
user_id: 0
430-
user_name: "John Doe"
431461
user_reference_id: "3248201907"
462+
usr:
463+
email: "test@example.com"
464+
id: 0
465+
name: "John Doe"
432466
visible_device_id: "ab-b1-83-20-65-de"
433-
vpn_user_email: "test@example.com"
434467
message: |-
435468
{
436469
"ISP_name" : "Bharti Airtel Ltd.",
@@ -488,8 +521,11 @@ tests:
488521
"event_id" : "e278205a1f4c73",
489522
"time" : 1763473282069
490523
}
524+
service: "events"
525+
status: "info"
491526
tags:
492527
- "source:LOGS_SOURCE"
528+
timestamp: 1763473282069
493529
-
494530
sample: |-
495531
{
@@ -515,8 +551,10 @@ tests:
515551
event_count: 1
516552
event_id: "a7cc4c4bb7feda4e"
517553
event_message: "License job applied 1 and revoked 0 licenses"
554+
event_status: "info"
518555
event_sub_type: "Sdp license"
519-
event_type: "System"
556+
evt:
557+
name: "System"
520558
internalId: "a7cc4c4bb7fe123a"
521559
internal_id: "a7cc4c4bb7feda4e"
522560
time: 1763531560065
@@ -536,5 +574,8 @@ tests:
536574
"event_message" : "License job applied 1 and revoked 0 licenses",
537575
"time_str" : "2025-11-19T05:52:40Z"
538576
}
577+
service: "events"
578+
status: "info"
539579
tags:
540580
- "source:LOGS_SOURCE"
581+
timestamp: 1763531560065

0 commit comments

Comments
 (0)