Skip to content

Commit 8718b40

Browse files
efd6anupratharamachandran
efd6
authored and
anupratharamachandran
committed
zscaler_zpa: fix IPProtocol mapping (elastic#13999)
The ingest pipeline was previously incorrectly mapping the values of IPProtocol to network.type when it should be mapped to network.transport.
1 parent adaae7e commit 8718b40

File tree

6 files changed

+49
-34
lines changed

6 files changed

+49
-34
lines changed

‎packages/zscaler_zpa/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.22.3"
3+
changes:
4+
- description: Fix handling of `IPProtocol` field mapping.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/13999
27
- version: "1.22.2"
38
changes:
49
- description: Fix handling of remote IP lists in audit data stream.

‎packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
]
3333
},
3434
"network": {
35-
"type": "ipv6"
35+
"transport": "tcp"
3636
},
3737
"organization": {
3838
"name": "Customer XYZ"

‎packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -102,15 +102,27 @@ processors:
102102
if: ctx.host?.domain != null
103103
allow_duplicates: false
104104
ignore_failure: true
105-
- set:
106-
field: network.type
107-
value: 'ipv4'
108-
if: ctx.json?.IPProtocol == 4
109-
ignore_failure: true
110-
- set:
111-
field: network.type
112-
value: 'ipv6'
113-
if: ctx.json?.IPProtocol == 6
105+
- script:
106+
if: ctx.json?.IPProtocol != null
107+
params:
108+
iana_numbers:
109+
"0": unknown_ip_ipprotocol
110+
"1": icmp
111+
"2": igmp
112+
"6": tcp
113+
"17": udp
114+
"41": ip6in4
115+
"47": gre
116+
"50": esp
117+
"58": icmp6
118+
"88": eigrp
119+
"97": etherip
120+
"103": pim
121+
"112": vrrp
122+
"132": sctp
123+
source: |-
124+
ctx.network = ctx.network ?: [:];
125+
ctx.network.transport = params.iana_numbers[ctx.json.IPProtocol.toString()];
114126
ignore_failure: true
115127
- rename:
116128
field: json.Customer

‎packages/zscaler_zpa/data_stream/user_activity/sample_event.json‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
11
{
22
"@timestamp": "2019-05-31T17:35:42.000Z",
33
"agent": {
4-
"ephemeral_id": "47a2e053-f9d2-4244-b6bd-9acf12361804",
5-
"hostname": "docker-fleet-agent",
6-
"id": "8b86614c-cda7-40f1-9823-ea2294fa4abf",
7-
"name": "docker-fleet-agent",
4+
"ephemeral_id": "dc5b8414-8d42-4bd7-820f-f19b6f07188b",
5+
"id": "43113495-332c-42b0-a84a-dfd7a28a3adc",
6+
"name": "elastic-agent-20487",
87
"type": "filebeat",
9-
"version": "7.16.2"
8+
"version": "8.13.0"
109
},
1110
"client": {
1211
"geo": {
@@ -20,24 +19,24 @@
2019
},
2120
"data_stream": {
2221
"dataset": "zscaler_zpa.user_activity",
23-
"namespace": "ep",
22+
"namespace": "11041",
2423
"type": "logs"
2524
},
2625
"ecs": {
2726
"version": "8.11.0"
2827
},
2928
"elastic_agent": {
30-
"id": "8b86614c-cda7-40f1-9823-ea2294fa4abf",
29+
"id": "43113495-332c-42b0-a84a-dfd7a28a3adc",
3130
"snapshot": false,
32-
"version": "7.16.2"
31+
"version": "8.13.0"
3332
},
3433
"event": {
3534
"agent_id_status": "verified",
3635
"category": [
3736
"iam"
3837
],
3938
"dataset": "zscaler_zpa.user_activity",
40-
"ingested": "2023-02-22T12:10:47Z",
39+
"ingested": "2025-05-25T22:58:32Z",
4140
"kind": "event",
4241
"original": "{\"LogTimestamp\": \"Fri May 31 17:35:42 2019\",\"Customer\": \"Customer XYZ\",\"SessionID\": \"LHJdkjmNDf12nclBsvwA\",\"ConnectionID\": \"SqyZIMkg0JTj7EABsvwA,Q+EjXGdrvbF2lPiBbedm\",\"InternalReason\": \"\",\"ConnectionStatus\": \"active\",\"IPProtocol\": 6,\"DoubleEncryption\": 0,\"Username\": \"ZPA LSS Client\",\"ServicePort\": 10011,\"ClientPublicIP\": \"81.2.69.193\",\"ClientLatitude\": 45.000000,\"ClientLongitude\": -119.000000,\"ClientCountryCode\": \"US\",\"ClientZEN\": \"broker2b.pdx\",\"Policy\": \"ABC Lab Apps\",\"Connector\": \"ZDEMO ABC\",\"ConnectorZEN\": \"broker2b.pdx\",\"ConnectorIP\": \"67.43.156.12\",\"ConnectorPort\": 60266,\"Host\": \"175.16.199.1\",\"Application\": \"ABC Lab Apps\",\"AppGroup\": \"ABC Lab Apps\",\"Server\": \"0\",\"ServerIP\": \"175.16.199.1\",\"ServerPort\": 10011,\"PolicyProcessingTime\": 28,\"CAProcessingTime\": 1330,\"ConnectorZENSetupTime\": 191017,\"ConnectionSetupTime\": 192397,\"ServerSetupTime\": 465,\"AppLearnTime\": 0,\"TimestampConnectionStart\": \"2019-05-30T08:20:42.230Z\",\"TimestampConnectionEnd\": \"\",\"TimestampCATx\": \"2019-05-30T08:20:42.230Z\",\"TimestampCARx\": \"2019-05-30T08:20:42.231Z\",\"TimestampAppLearnStart\": \"\",\"TimestampZENFirstRxClient\": \"2019-05-30T08:20:42.424Z\",\"TimestampZENFirstTxClient\": \"\",\"TimestampZENLastRxClient\": \"2019-05-31T17:34:27.348Z\",\"TimestampZENLastTxClient\": \"\",\"TimestampConnectorZENSetupComplete\": \"2019-05-30T08:20:42.422Z\",\"TimestampZENFirstRxConnector\": \"\",\"TimestampZENFirstTxConnector\": \"2019-05-30T08:20:42.424Z\",\"TimestampZENLastRxConnector\": \"\",\"TimestampZENLastTxConnector\": \"2019-05-31T17:34:27.348Z\",\"ZENTotalBytesRxClient\": 2406926,\"ZENBytesRxClient\": 7115,\"ZENTotalBytesTxClient\": 0,\"ZENBytesTxClient\": 0,\"ZENTotalBytesRxConnector\": 0,\"ZENBytesRxConnector\": 0,\"ZENTotalBytesTxConnector\": 2406926,\"ZENBytesTxConnector\": 7115,\"Idp\": \"Example IDP Config\",\"ClientToClient\": \"0\"}",
4342
"type": [
@@ -55,11 +54,11 @@
5554
},
5655
"log": {
5756
"source": {
58-
"address": "192.168.64.5:60604"
57+
"address": "172.19.0.3:52362"
5958
}
6059
},
6160
"network": {
62-
"type": "ipv6"
61+
"transport": "tcp"
6362
},
6463
"organization": {
6564
"name": "Customer XYZ"
@@ -165,4 +164,4 @@
165164
}
166165
}
167166
}
168-
}
167+
}

‎packages/zscaler_zpa/docs/README.md‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -699,12 +699,11 @@ An example event for `user_activity` looks as following:
699699
{
700700
"@timestamp": "2019-05-31T17:35:42.000Z",
701701
"agent": {
702-
"ephemeral_id": "47a2e053-f9d2-4244-b6bd-9acf12361804",
703-
"hostname": "docker-fleet-agent",
704-
"id": "8b86614c-cda7-40f1-9823-ea2294fa4abf",
705-
"name": "docker-fleet-agent",
702+
"ephemeral_id": "dc5b8414-8d42-4bd7-820f-f19b6f07188b",
703+
"id": "43113495-332c-42b0-a84a-dfd7a28a3adc",
704+
"name": "elastic-agent-20487",
706705
"type": "filebeat",
707-
"version": "7.16.2"
706+
"version": "8.13.0"
708707
},
709708
"client": {
710709
"geo": {
@@ -718,24 +717,24 @@ An example event for `user_activity` looks as following:
718717
},
719718
"data_stream": {
720719
"dataset": "zscaler_zpa.user_activity",
721-
"namespace": "ep",
720+
"namespace": "11041",
722721
"type": "logs"
723722
},
724723
"ecs": {
725724
"version": "8.11.0"
726725
},
727726
"elastic_agent": {
728-
"id": "8b86614c-cda7-40f1-9823-ea2294fa4abf",
727+
"id": "43113495-332c-42b0-a84a-dfd7a28a3adc",
729728
"snapshot": false,
730-
"version": "7.16.2"
729+
"version": "8.13.0"
731730
},
732731
"event": {
733732
"agent_id_status": "verified",
734733
"category": [
735734
"iam"
736735
],
737736
"dataset": "zscaler_zpa.user_activity",
738-
"ingested": "2023-02-22T12:10:47Z",
737+
"ingested": "2025-05-25T22:58:32Z",
739738
"kind": "event",
740739
"original": "{\"LogTimestamp\": \"Fri May 31 17:35:42 2019\",\"Customer\": \"Customer XYZ\",\"SessionID\": \"LHJdkjmNDf12nclBsvwA\",\"ConnectionID\": \"SqyZIMkg0JTj7EABsvwA,Q+EjXGdrvbF2lPiBbedm\",\"InternalReason\": \"\",\"ConnectionStatus\": \"active\",\"IPProtocol\": 6,\"DoubleEncryption\": 0,\"Username\": \"ZPA LSS Client\",\"ServicePort\": 10011,\"ClientPublicIP\": \"81.2.69.193\",\"ClientLatitude\": 45.000000,\"ClientLongitude\": -119.000000,\"ClientCountryCode\": \"US\",\"ClientZEN\": \"broker2b.pdx\",\"Policy\": \"ABC Lab Apps\",\"Connector\": \"ZDEMO ABC\",\"ConnectorZEN\": \"broker2b.pdx\",\"ConnectorIP\": \"67.43.156.12\",\"ConnectorPort\": 60266,\"Host\": \"175.16.199.1\",\"Application\": \"ABC Lab Apps\",\"AppGroup\": \"ABC Lab Apps\",\"Server\": \"0\",\"ServerIP\": \"175.16.199.1\",\"ServerPort\": 10011,\"PolicyProcessingTime\": 28,\"CAProcessingTime\": 1330,\"ConnectorZENSetupTime\": 191017,\"ConnectionSetupTime\": 192397,\"ServerSetupTime\": 465,\"AppLearnTime\": 0,\"TimestampConnectionStart\": \"2019-05-30T08:20:42.230Z\",\"TimestampConnectionEnd\": \"\",\"TimestampCATx\": \"2019-05-30T08:20:42.230Z\",\"TimestampCARx\": \"2019-05-30T08:20:42.231Z\",\"TimestampAppLearnStart\": \"\",\"TimestampZENFirstRxClient\": \"2019-05-30T08:20:42.424Z\",\"TimestampZENFirstTxClient\": \"\",\"TimestampZENLastRxClient\": \"2019-05-31T17:34:27.348Z\",\"TimestampZENLastTxClient\": \"\",\"TimestampConnectorZENSetupComplete\": \"2019-05-30T08:20:42.422Z\",\"TimestampZENFirstRxConnector\": \"\",\"TimestampZENFirstTxConnector\": \"2019-05-30T08:20:42.424Z\",\"TimestampZENLastRxConnector\": \"\",\"TimestampZENLastTxConnector\": \"2019-05-31T17:34:27.348Z\",\"ZENTotalBytesRxClient\": 2406926,\"ZENBytesRxClient\": 7115,\"ZENTotalBytesTxClient\": 0,\"ZENBytesTxClient\": 0,\"ZENTotalBytesRxConnector\": 0,\"ZENBytesRxConnector\": 0,\"ZENTotalBytesTxConnector\": 2406926,\"ZENBytesTxConnector\": 7115,\"Idp\": \"Example IDP Config\",\"ClientToClient\": \"0\"}",
741740
"type": [
@@ -753,11 +752,11 @@ An example event for `user_activity` looks as following:
753752
},
754753
"log": {
755754
"source": {
756-
"address": "192.168.64.5:60604"
755+
"address": "172.19.0.3:52362"
757756
}
758757
},
759758
"network": {
760-
"type": "ipv6"
759+
"transport": "tcp"
761760
},
762761
"organization": {
763762
"name": "Customer XYZ"

‎packages/zscaler_zpa/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.3"
22
name: zscaler_zpa
33
title: Zscaler Private Access
4-
version: "1.22.2"
4+
version: "1.22.3"
55
source:
66
license: Elastic-2.0
77
description: Collect logs from Zscaler Private Access (ZPA) with Elastic Agent.

0 commit comments

Comments
 (0)