Skip to content

Commit ff041f2

Browse files
haetamoudiagithomas
haetamoudi
authored and
agithomas
committed
checkpoint_firewall: update count types from integer to long
1 parent 377b537 commit ff041f2

File tree

7 files changed

+106
-10
lines changed

7 files changed

+106
-10
lines changed

‎packages/checkpoint/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.41.2"
3+
changes:
4+
- description: Update update_count, connection_count, aggregated_log_count types from integer to long.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15673
27
- version: "1.41.1"
38
changes:
49
- description: Changed owners.

‎packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,4 @@
1717
<134>1 2023-03-02T03:28:09Z gw-0b8ccd CheckPoint 15871 - [action:"Block"; flags:"311552"; ifdir:"outbound"; ifname:"eth1"; loguid:"{0x291ee176,0x3488469e,0xdb759c74,0xc0134e9a}"; origin:"192.168.178.40"; originsicname:"cn=cp_mgmt,o=gw-0b8ccd..zx8qy7"; sequencenum:"1"; time:"1677727689"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={48483CA8-998B-2D46-BEEF-CE5DA956505D};mgmt=gw-0b8ccd;date=1677720751;policy_name=Standard\]"; confidence_level:"5"; dlp_incident_uid:"{640017C9-0000-0001-27C5-C5E7C1878B89}"; dst:"81.2.69.144"; frequency:"1 days "; http_host:"sc1.checkpoint.com"; lastupdatetime:"1677727691"; log_id:"4294967295"; malware_action:"Communication with C&C site"; malware_family:"Check Point"; malware_rule_id:"{F50127A1-D5C9-4BAC-8C3F-2D2557E6FFAD}"; method:"GET"; packet_capture_name:"src-10.0.0.3.cap"; packet_capture_time:"1677727690"; packet_capture_unique_id:"time1677727689.id640acbe0.blade04"; policy:"Standard"; policy_time:"1677720775"; portal_message:"Your computer is trying to access a malicious server. It is probably infected by malware. For more information and remediation, please contact your help desk. Click here to report an incorrect classification. Activity: Communication with C&C site URL: http://sc1.checkpoint.com/za/images/threatwiki/pages/TestAntiBotBlade.html Reference: 498D79F3"; product:"Anti Malware"; protection_id:"00233CFEE"; protection_name:"Check Point - Testing Bot"; protection_type:"URL reputation"; proto:"6"; proxy_src_ip:"10.0.0.3"; resource:"http://sc1.checkpoint.com/za/images/threatwiki/pages/TestAntiBotBlade.html"; s_port:"34416"; scope:"10.0.0.3"; service:"80"; service_id:"http"; session_id:"{0x640017c9,0x1,0x27c5c5e7,0xc1878b89}"; severity:"2"; smartdefense_profile:"Optimized"; src:"10.0.0.3"; layer_name:"Standard Threat Prevention"; layer_uuid:"{6CC286F4-87BC-412A-B231-8C63C30D978E}"; malware_rule_id:"{F50127A1-D5C9-4BAC-8C3F-2D2557E6FFAD}"; smartdefense_profile:"Optimized"; user_agent:"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0) Gecko/20100101 Firefox/93.0"; usercheck:"1"; usercheck_confirmation_level:"Application"; usercheck_incident_uid:"C9B778BF-CA91-A050-2673-53F9498D79F3"; usercheck_interaction_name:"Anti-Bot Blocked"; web_client_type:"Firefox"]
1818
<134>1 2023-03-02T03:28:09Z gw-0b8ccd CheckPoint 15871 - [action:"Block"; flags:"311552"; ifdir:"outbound"; ifname:"eth1"; loguid:"{0x291ee176,0x3488469e,0xdb759c74,0xc0134e9a}"; origin:"192.168.178.40"; originsicname:"cn=cp_mgmt,o=gw-0b8ccd..zx8qy7"; sequencenum:"1"; time:"1677727689"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={48483CA8-998B-2D46-BEEF-CE5DA956505D};mgmt=gw-0b8ccd;date=1677720751;policy_name=Standard\]"; confidence_level:"5"; dlp_incident_uid:"{640017C9-0000-0001-27C5-C5E7C1878B89}"; dst:"81.2.69.144"; frequency:"1 days "; http_host:"sc1.checkpoint.com"; lastupdatetime:"1677727750"; log_id:"2"; malware_action:"Communication with C&C site"; malware_family:"Check Point"; malware_rule_id:"{F50127A1-D5C9-4BAC-8C3F-2D2557E6FFAD}"; method:"GET"; packet_capture_name:"src-10.0.0.3.cap"; packet_capture_time:"1677727690"; packet_capture_unique_id:"time1677727689.id640acbe0.blade04"; policy:"Standard"; policy_time:"1677720775"; portal_message:"Your computer is trying to access a malicious server. It is probably infected by malware. For more information and remediation, please contact your help desk. Click here to report an incorrect classification. Activity: Communication with C&C site URL: http://sc1.checkpoint.com/za/images/threatwiki/pages/TestAntiBotBlade.html Reference: 498D79F3"; product:"Anti Malware"; protection_id:"00233CFEE"; protection_name:"Check Point - Testing Bot"; protection_type:"URL reputation"; proto:"6"; proxy_src_ip:"10.0.0.3"; received_bytes:"60"; resource:"http://sc1.checkpoint.com/za/images/threatwiki/pages/TestAntiBotBlade.html"; s_port:"34416"; scope:"10.0.0.3"; sent_bytes:"0"; service:"80"; service_id:"http"; session_id:"{0x640017c9,0x1,0x27c5c5e7,0xc1878b89}"; severity:"2"; smartdefense_profile:"Optimized"; src:"10.0.0.3"; suppressed_logs:"1"; layer_name:"Standard Threat Prevention"; layer_uuid:"{6CC286F4-87BC-412A-B231-8C63C30D978E}"; malware_rule_id:"{F50127A1-D5C9-4BAC-8C3F-2D2557E6FFAD}"; smartdefense_profile:"Optimized"; user_agent:"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0) Gecko/20100101 Firefox/93.0"; usercheck:"1"; usercheck_confirmation_level:"Application"; usercheck_incident_uid:"C9B778BF-CA91-A050-2673-53F9498D79F3"; usercheck_interaction_name:"Anti-Bot Blocked"; web_client_type:"Firefox"]
1919
<134>1 2024-12-19T08:34:14Z gw-0b8ccd CheckPoint 15871 - [action:"Accept"; flags:"16384"; ifdir:"inbound"; ifname:"eth4"; logid:"288"; loguid:"{0xb2dea3d4,0xbf9adbd4,0xbdc92bc5,0xf8a33399}"; origin:"1.2.3.4"; originsicname:"CN=cp_mgmt,O=gw-0b8ccd..zx8qy7"; sequencenum:"9"; time:"1734597254"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={48483CA8-998B-2D46-BEEF-CE5DA956505D};mgmt=gw-0b8ccd;date=1733928424;policy_name=Standard\]"; aggregated_log_count:"2"; connection_count:"2"; creation_time:"1734595323"; dst:"192.168.0.10"; duration:"1931"; hll_key:"6549446380911603098"; inzone:"Internal"; last_hit_time:"1734597254"; layer_name:"Network"; layer_name:"Admin Traffic"; layer_uuid:"c135090e-7d3a-44bf-b686-1589d3183102"; layer_uuid:"42f39ab2-d932-4b6b-abbf-8b6bd519e15b"; match_id:"34"; match_id:"67108866"; parent_rule:"0"; parent_rule:"34"; rule_action:"Inline"; rule_action:"Accept"; rule_name:"Traffic Outbound"; rule_name:"Traffic outbound"; rule_uid:"31aca655-e044-4f8d-91bf-5de3505f443b"; rule_uid:"ee877954-c304-4159-bda3-e8f78ed4a4fa"; outzone:"External"; product:"VPN-1 & FireWall-1"; proto:"17"; service:"389"; service_id:"ldap_udp"; src:"192.168.20.10"; update_count:"2"]
20+
<134>1 2024-12-19T08:34:14Z gw-0b8ccd CheckPoint 15871 - [action:"Accept"; flags:"16384"; ifdir:"inbound"; ifname:"eth4"; logid:"288"; loguid:"{0xb2dea3d4,0xbf9adbd4,0xbdc92bc5,0xf8a33399}"; origin:"1.2.3.4"; originsicname:"CN=cp_mgmt,O=gw-0b8ccd..zx8qy7"; sequencenum:"9"; time:"1734597254"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={48483CA8-998B-2D46-BEEF-CE5DA956505D};mgmt=gw-0b8ccd;date=1733928424;policy_name=Standard\]"; aggregated_log_count:"4294947622"; connection_count:"4294947622"; creation_time:"1734595323"; dst:"192.168.0.10"; duration:"1931"; hll_key:"6549446380911603098"; inzone:"Internal"; last_hit_time:"1734597254"; layer_name:"Network"; layer_name:"Admin Traffic"; layer_uuid:"c135090e-7d3a-44bf-b686-1589d3183102"; layer_uuid:"42f39ab2-d932-4b6b-abbf-8b6bd519e15b"; match_id:"34"; match_id:"67108866"; parent_rule:"0"; parent_rule:"34"; rule_action:"Inline"; rule_action:"Accept"; rule_name:"Traffic Outbound"; rule_name:"Traffic outbound"; rule_uid:"31aca655-e044-4f8d-91bf-5de3505f443b"; rule_uid:"ee877954-c304-4159-bda3-e8f78ed4a4fa"; outzone:"External"; product:"VPN-1 & FireWall-1"; proto:"17"; service:"389"; service_id:"ldap_udp"; src:"192.168.20.10"; update_count:"4294947622"]

‎packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1311,6 +1311,96 @@
13111311
"tags": [
13121312
"preserve_original_event"
13131313
]
1314+
},
1315+
{
1316+
"@timestamp": "2024-12-19T08:34:14.000Z",
1317+
"checkpoint": {
1318+
"aggregated_log_count": 4294947622,
1319+
"connection_count": 4294947622,
1320+
"logid": "288",
1321+
"match_id": [
1322+
"34",
1323+
"67108866"
1324+
],
1325+
"origin_sic_name": "CN=cp_mgmt,O=gw-0b8ccd..zx8qy7",
1326+
"parent_rule": [
1327+
"0",
1328+
"34"
1329+
],
1330+
"rule_action": [
1331+
"Inline",
1332+
"Accept"
1333+
],
1334+
"update_count": 4294947622
1335+
},
1336+
"destination": {
1337+
"ip": "192.168.0.10",
1338+
"port": 389
1339+
},
1340+
"ecs": {
1341+
"version": "8.17.0"
1342+
},
1343+
"event": {
1344+
"action": "Accept",
1345+
"category": [
1346+
"network"
1347+
],
1348+
"duration": 1931000000000,
1349+
"end": "2024-12-19T08:34:14.000Z",
1350+
"id": "{0xb2dea3d4,0xbf9adbd4,0xbdc92bc5,0xf8a33399}",
1351+
"kind": "event",
1352+
"original": "<134>1 2024-12-19T08:34:14Z gw-0b8ccd CheckPoint 15871 - [action:\"Accept\"; flags:\"16384\"; ifdir:\"inbound\"; ifname:\"eth4\"; logid:\"288\"; loguid:\"{0xb2dea3d4,0xbf9adbd4,0xbdc92bc5,0xf8a33399}\"; origin:\"1.2.3.4\"; originsicname:\"CN=cp_mgmt,O=gw-0b8ccd..zx8qy7\"; sequencenum:\"9\"; time:\"1734597254\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={48483CA8-998B-2D46-BEEF-CE5DA956505D};mgmt=gw-0b8ccd;date=1733928424;policy_name=Standard\\]\"; aggregated_log_count:\"4294947622\"; connection_count:\"4294947622\"; creation_time:\"1734595323\"; dst:\"192.168.0.10\"; duration:\"1931\"; hll_key:\"6549446380911603098\"; inzone:\"Internal\"; last_hit_time:\"1734597254\"; layer_name:\"Network\"; layer_name:\"Admin Traffic\"; layer_uuid:\"c135090e-7d3a-44bf-b686-1589d3183102\"; layer_uuid:\"42f39ab2-d932-4b6b-abbf-8b6bd519e15b\"; match_id:\"34\"; match_id:\"67108866\"; parent_rule:\"0\"; parent_rule:\"34\"; rule_action:\"Inline\"; rule_action:\"Accept\"; rule_name:\"Traffic Outbound\"; rule_name:\"Traffic outbound\"; rule_uid:\"31aca655-e044-4f8d-91bf-5de3505f443b\"; rule_uid:\"ee877954-c304-4159-bda3-e8f78ed4a4fa\"; outzone:\"External\"; product:\"VPN-1 & FireWall-1\"; proto:\"17\"; service:\"389\"; service_id:\"ldap_udp\"; src:\"192.168.20.10\"; update_count:\"4294947622\"]",
1353+
"sequence": 9,
1354+
"start": "2024-12-19T08:02:03.000Z",
1355+
"timezone": "UTC"
1356+
},
1357+
"network": {
1358+
"application": "ldap_udp",
1359+
"direction": "inbound",
1360+
"iana_number": "17",
1361+
"name": [
1362+
"Network",
1363+
"Admin Traffic"
1364+
],
1365+
"transport": "udp"
1366+
},
1367+
"observer": {
1368+
"egress": {
1369+
"zone": "External"
1370+
},
1371+
"ingress": {
1372+
"interface": {
1373+
"name": "eth4"
1374+
},
1375+
"zone": "Internal"
1376+
},
1377+
"name": "1.2.3.4",
1378+
"product": "VPN-1 & FireWall-1",
1379+
"type": "firewall",
1380+
"vendor": "Checkpoint"
1381+
},
1382+
"related": {
1383+
"ip": [
1384+
"192.168.20.10",
1385+
"192.168.0.10"
1386+
]
1387+
},
1388+
"rule": {
1389+
"name": [
1390+
"Traffic Outbound",
1391+
"Traffic outbound"
1392+
],
1393+
"uuid": [
1394+
"31aca655-e044-4f8d-91bf-5de3505f443b",
1395+
"ee877954-c304-4159-bda3-e8f78ed4a4fa"
1396+
]
1397+
},
1398+
"source": {
1399+
"ip": "192.168.20.10"
1400+
},
1401+
"tags": [
1402+
"preserve_original_event"
1403+
]
13141404
}
13151405
]
13161406
}

‎packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1144,15 +1144,15 @@ processors:
11441144
if: ctx.event?.duration != null
11451145
- convert:
11461146
field: checkpoint.update_count
1147-
type: integer
1147+
type: long
11481148
ignore_missing: true
11491149
- convert:
11501150
field: checkpoint.connection_count
1151-
type: integer
1151+
type: long
11521152
ignore_missing: true
11531153
- convert:
11541154
field: checkpoint.aggregated_log_count
1155-
type: integer
1155+
type: long
11561156
ignore_missing: true
11571157
- rename:
11581158
field: checkpoint.message

‎packages/checkpoint/data_stream/firewall/fields/fields.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
description: |
2727
Source administrator name.
2828
- name: aggregated_log_count
29-
type: integer
29+
type: long
3030
description: |
3131
Number of logs aggregated in the event.
3232
- name: alert
@@ -219,7 +219,7 @@
219219
type: keyword
220220
description: Connection direction
221221
- name: connection_count
222-
type: integer
222+
type: long
223223
description: Number of connections logged in this event
224224
- name: connection_uid
225225
type: keyword
@@ -1675,7 +1675,7 @@
16751675
description: |
16761676
Detected virus for a specific host during the last week.
16771677
- name: update_count
1678-
type: integer
1678+
type: long
16791679
description: Number of times the event has been updated with new occurrences
16801680
- name: update_status
16811681
type: keyword

‎packages/checkpoint/docs/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ An example event for `firewall` looks as following:
147147
| checkpoint.additional_rdata | List of additional resource records. | keyword |
148148
| checkpoint.administrator | Source administrator name. | keyword |
149149
| checkpoint.advanced_changes | | keyword |
150-
| checkpoint.aggregated_log_count | Number of logs aggregated in the event. | integer |
150+
| checkpoint.aggregated_log_count | Number of logs aggregated in the event. | long |
151151
| checkpoint.alert | Alert level of matched rule (for connection logs). | keyword |
152152
| checkpoint.allocated_ports | Amount of allocated ports. | integer |
153153
| checkpoint.analyzed_on | Check Point ThreatCloud / emulator name. | keyword |
@@ -197,7 +197,7 @@ An example event for `firewall` looks as following:
197197
| checkpoint.community | Community name for the IPSec key and the use of the IKEv. | keyword |
198198
| checkpoint.confidence_level | Confidence level determined by ThreatCloud. | integer |
199199
| checkpoint.conn_direction | Connection direction | keyword |
200-
| checkpoint.connection_count | Number of connections logged in this event | integer |
200+
| checkpoint.connection_count | Number of connections logged in this event | long |
201201
| checkpoint.connection_uid | Calculation of md5 of the IP and user name as UID. | keyword |
202202
| checkpoint.connectivity_level | Log for a new connection in wire mode. | keyword |
203203
| checkpoint.conns_amount | Connections amount of aggregated log info. | integer |
@@ -600,7 +600,7 @@ An example event for `firewall` looks as following:
600600
| checkpoint.unique_detected_day | Detected virus for a specific host during the last day. | integer |
601601
| checkpoint.unique_detected_hour | Detected virus for a specific host during the last hour. | integer |
602602
| checkpoint.unique_detected_week | Detected virus for a specific host during the last week. | integer |
603-
| checkpoint.update_count | Number of times the event has been updated with new occurrences | integer |
603+
| checkpoint.update_count | Number of times the event has been updated with new occurrences | long |
604604
| checkpoint.update_status | Status of database update | keyword |
605605
| checkpoint.url | Translated URL. | keyword |
606606
| checkpoint.user | Source user name. | keyword |

‎packages/checkpoint/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: checkpoint
22
title: Check Point
3-
version: "1.41.1"
3+
version: "1.41.2"
44
description: Collect logs from Check Point with Elastic Agent.
55
type: integration
66
format_version: "3.0.3"

0 commit comments

Comments
 (0)