Skip to content

Commit 3e63dee

Browse files
chemamartinezchemamartinez
authored
abnormal_security: add support for Not Analyzed Messages data stream (#13483)
Add support for AI Security Mailbox Not Analyzed data stream.
1 parent cdd2c34 commit 3e63dee

35 files changed

+1865
-35
lines changed

‎packages/abnormal_security/_dev/build/docs/README.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,12 @@ The Abnormal Security integration collects data for AI Security Mailbox (formerl
66

77
## Data streams
88

9-
The Abnormal Security integration collects four types of logs:
9+
The Abnormal Security integration collects six types of logs:
1010

1111
- **[AI Security Mailbox](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/AI%20Security%20Mailbox%20(formerly%20known%20as%20Abuse%20Mailbox))** - Get details of AI Security Mailbox.
1212

13+
- **[AI Security Mailbox Not Analyzed](https://app.swaggerhub.com/apis/abnormal-security/abx/1.4.3#/AI%20Security%20Mailbox%20(formerly%20known%20as%20Abuse%20Mailbox)/v1_abuse_mailbox_not_analyzed_retrieve)** - Get details of messages submitted to AI Security Mailbox that were not analyzed.
14+
1315
- **[Audit](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Audit%20Logs)** - Get details of Audit logs for Portal.
1416

1517
- **[Case](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Cases)** - Get details of Abnormal Cases.
@@ -76,6 +78,16 @@ This is the `ai_security_mailbox` dataset.
7678

7779
{{fields "ai_security_mailbox"}}
7880

81+
### AI Security Mailbox Not Analyzed
82+
83+
This is the `ai_security_mailbox_not_analyzed` dataset.
84+
85+
#### Example
86+
87+
{{event "ai_security_mailbox_not_analyzed"}}
88+
89+
{{fields "ai_security_mailbox_not_analyzed"}}
90+
7991
### Audit
8092

8193
This is the `audit` dataset.

‎packages/abnormal_security/_dev/deploy/docker/files/config.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,65 @@ rules:
101101
"attackType": "Attack Type: Spam"
102102
}
103103
`}}
104+
- path: /v1/abuse_mailbox/not_analyzed
105+
methods: ['GET']
106+
request_headers:
107+
Authorization:
108+
- "Bearer xxxx"
109+
responses:
110+
- status_code: 200
111+
headers:
112+
Content-Type:
113+
- 'application/json'
114+
body: |-
115+
{{ minify_json `
116+
{
117+
"results": [
118+
{
119+
"abx_message_id": -7361381340273523750,
120+
"recipient": {
121+
"email": "[email protected]",
122+
"name": "Phishing Test"
123+
},
124+
"reported_datetime": "2025-03-06T17:27:15Z",
125+
"reporter": {
126+
"email": "[email protected]",
127+
"name": "Reporter Test"
128+
},
129+
"subject": "Re: Subject",
130+
"not_analyzed_reason": "ROUTED_SUBMISSION"
131+
},
132+
{
133+
"abx_message_id": 240750237502375023,
134+
"recipient": {
135+
"email": "[email protected]",
136+
"name": "Phishing Test"
137+
},
138+
"reported_datetime": "2025-03-04T18:50:27Z",
139+
"reporter": {
140+
"email": "[email protected]",
141+
"name": "Test Example"
142+
},
143+
"subject": "Fwd: Forwarded email",
144+
"not_analyzed_reason": "INVALID_SUBMISSION"
145+
},
146+
{
147+
"abx_message_id": -1234567891234567891,
148+
"recipient": {
149+
"email": "[email protected]",
150+
"name": "Phishing Test"
151+
},
152+
"reported_datetime": "2025-03-04T17:03:55Z",
153+
"reporter": {
154+
"email": "[email protected]",
155+
"name": "Info Test"
156+
},
157+
"subject": "Fwd: Forwarded email",
158+
"not_analyzed_reason": "PHISHING_SIMULATION"
159+
}
160+
]
161+
}
162+
`}}
104163
- path: /v1/auditlogs
105164
methods: ['GET']
106165
query_params:

‎packages/abnormal_security/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.6.0"
3+
changes:
4+
- description: New data stream for not analyzed messages in AI Security Mailbox.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13483
27
- version: "1.5.0"
38
changes:
49
- description: Added support for vendor case data stream.

‎packages/abnormal_security/data_stream/ai_security_mailbox/agent/stream/cel.yml.hbs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
config_version: 2
22
interval: {{interval}}
3-
{{#if enable_request_tracer}}
4-
resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson"
5-
resource.tracer.maxbackups: 5
6-
{{/if}}
3+
resource.tracer:
4+
enabled: {{enable_request_tracer}}
5+
filename: "../../logs/cel/http-request-trace-*.ndjson"
6+
maxbackups: 5
77
{{#if proxy_url}}
88
resource.proxy_url: {{proxy_url}}
99
{{/if}}

‎packages/abnormal_security/data_stream/ai_security_mailbox/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ streams:
4444
multi: false
4545
required: false
4646
show_user: false
47-
description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.
47+
description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.
4848
- name: tags
4949
type: text
5050
title: Tags

‎packages/abnormal_security/data_stream/ai_security_mailbox_not_analyzed/_dev/test/pipeline/test-ai-security-mailbox-not-analyzed.log‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{"abx_message_id":-7361381340273523750,"recipient":{"email":"[email protected]","name":"Phishing Test"},"reported_datetime":"2025-03-06T17:27:15Z","reporter":{"email":"[email protected]","name":"Reporter Test"},"subject":"Re: Subject","not_analyzed_reason":"ROUTED_SUBMISSION"}
2+
{"abx_message_id":240750237502375023,"recipient":{"email":"[email protected]","name":"Phishing Test"},"reported_datetime":"2025-03-04T18:50:27Z","reporter":{"email":"[email protected]","name":"Test Example"},"subject":"Fw: Forwarded email","not_analyzed_reason":"INVALID_SUBMISSION"}
3+
{"abx_message_id":-1234567891234567891,"recipient":{"email":"[email protected]","name":"Phishing Test"},"reported_datetime":"2025-03-04T17:03:55Z","reporter":{"email":"[email protected]","name":"Info Test"},"subject":"Fwd: Forwarded email","not_analyzed_reason":"PHISHING_SIMULATION"}

‎packages/abnormal_security/data_stream/ai_security_mailbox_not_analyzed/_dev/test/pipeline/test-ai-security-mailbox-not-analyzed.log-expected.json‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2025-03-06T17:27:15.000Z",
5+
"abnormal_security": {
6+
"ai_security_mailbox_not_analyzed": {
7+
"abx_message_id": "-7361381340273523750",
8+
"reason": "ROUTED_SUBMISSION",
9+
"recipient": {
10+
"address": "[email protected]",
11+
"name": "Phishing Test"
12+
},
13+
"reported_time": "2025-03-06T17:27:15Z",
14+
"reporter": {
15+
"address": "[email protected]",
16+
"name": "Reporter Test"
17+
},
18+
"subject": "Re: Subject"
19+
}
20+
},
21+
"ecs": {
22+
"version": "8.11.0"
23+
},
24+
"email": {
25+
"subject": "Re: Subject",
26+
"to": {
27+
"address": [
28+
"[email protected]"
29+
]
30+
}
31+
},
32+
"event": {
33+
"category": [
34+
"email"
35+
],
36+
"id": "-7361381340273523750",
37+
"kind": "event",
38+
"original": "{\"abx_message_id\":-7361381340273523750,\"recipient\":{\"email\":\"[email protected]\",\"name\":\"Phishing Test\"},\"reported_datetime\":\"2025-03-06T17:27:15Z\",\"reporter\":{\"email\":\"[email protected]\",\"name\":\"Reporter Test\"},\"subject\":\"Re: Subject\",\"not_analyzed_reason\":\"ROUTED_SUBMISSION\"}",
39+
"reason": "ROUTED_SUBMISSION",
40+
"type": [
41+
"info"
42+
]
43+
},
44+
"observer": {
45+
"product": "Inbound Email Security",
46+
"vendor": "Abnormal"
47+
},
48+
"related": {
49+
"user": [
50+
"[email protected]",
51+
"Phishing Test",
52+
"[email protected]",
53+
"Reporter Test"
54+
]
55+
},
56+
"tags": [
57+
"preserve_duplicate_custom_fields"
58+
]
59+
},
60+
{
61+
"@timestamp": "2025-03-04T18:50:27.000Z",
62+
"abnormal_security": {
63+
"ai_security_mailbox_not_analyzed": {
64+
"abx_message_id": "240750237502375023",
65+
"reason": "INVALID_SUBMISSION",
66+
"recipient": {
67+
"address": "[email protected]",
68+
"name": "Phishing Test"
69+
},
70+
"reported_time": "2025-03-04T18:50:27Z",
71+
"reporter": {
72+
"address": "[email protected]",
73+
"name": "Test Example"
74+
},
75+
"subject": "Fw: Forwarded email"
76+
}
77+
},
78+
"ecs": {
79+
"version": "8.11.0"
80+
},
81+
"email": {
82+
"subject": "Fw: Forwarded email",
83+
"to": {
84+
"address": [
85+
"[email protected]"
86+
]
87+
}
88+
},
89+
"event": {
90+
"category": [
91+
"email"
92+
],
93+
"id": "240750237502375023",
94+
"kind": "event",
95+
"original": "{\"abx_message_id\":240750237502375023,\"recipient\":{\"email\":\"[email protected]\",\"name\":\"Phishing Test\"},\"reported_datetime\":\"2025-03-04T18:50:27Z\",\"reporter\":{\"email\":\"[email protected]\",\"name\":\"Test Example\"},\"subject\":\"Fw: Forwarded email\",\"not_analyzed_reason\":\"INVALID_SUBMISSION\"}",
96+
"reason": "INVALID_SUBMISSION",
97+
"type": [
98+
"info"
99+
]
100+
},
101+
"observer": {
102+
"product": "Inbound Email Security",
103+
"vendor": "Abnormal"
104+
},
105+
"related": {
106+
"user": [
107+
"[email protected]",
108+
"Phishing Test",
109+
"[email protected]",
110+
"Test Example"
111+
]
112+
},
113+
"tags": [
114+
"preserve_duplicate_custom_fields"
115+
]
116+
},
117+
{
118+
"@timestamp": "2025-03-04T17:03:55.000Z",
119+
"abnormal_security": {
120+
"ai_security_mailbox_not_analyzed": {
121+
"abx_message_id": "-1234567891234567891",
122+
"reason": "PHISHING_SIMULATION",
123+
"recipient": {
124+
"address": "[email protected]",
125+
"name": "Phishing Test"
126+
},
127+
"reported_time": "2025-03-04T17:03:55Z",
128+
"reporter": {
129+
"address": "[email protected]",
130+
"name": "Info Test"
131+
},
132+
"subject": "Fwd: Forwarded email"
133+
}
134+
},
135+
"ecs": {
136+
"version": "8.11.0"
137+
},
138+
"email": {
139+
"subject": "Fwd: Forwarded email",
140+
"to": {
141+
"address": [
142+
"[email protected]"
143+
]
144+
}
145+
},
146+
"event": {
147+
"category": [
148+
"email"
149+
],
150+
"id": "-1234567891234567891",
151+
"kind": "event",
152+
"original": "{\"abx_message_id\":-1234567891234567891,\"recipient\":{\"email\":\"[email protected]\",\"name\":\"Phishing Test\"},\"reported_datetime\":\"2025-03-04T17:03:55Z\",\"reporter\":{\"email\":\"[email protected]\",\"name\":\"Info Test\"},\"subject\":\"Fwd: Forwarded email\",\"not_analyzed_reason\":\"PHISHING_SIMULATION\"}",
153+
"reason": "PHISHING_SIMULATION",
154+
"type": [
155+
"info"
156+
]
157+
},
158+
"observer": {
159+
"product": "Inbound Email Security",
160+
"vendor": "Abnormal"
161+
},
162+
"related": {
163+
"user": [
164+
"[email protected]",
165+
"Phishing Test",
166+
"[email protected]",
167+
"Info Test"
168+
]
169+
},
170+
"tags": [
171+
"preserve_duplicate_custom_fields"
172+
]
173+
}
174+
]
175+
}

‎packages/abnormal_security/data_stream/ai_security_mailbox_not_analyzed/_dev/test/pipeline/test-common-config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
fields:
2+
tags:
3+
- preserve_duplicate_custom_fields

‎packages/abnormal_security/data_stream/ai_security_mailbox_not_analyzed/_dev/test/system/test-default-config.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
input: cel
2+
service: abnormal_security
3+
vars:
4+
url: http://{{Hostname}}:{{Port}}
5+
access_token: xxxx
6+
data_stream:
7+
vars:
8+
interval: 1h
9+
initial_interval: 2160h
10+
preserve_original_event: true
11+
preserve_duplicate_custom_fields: true
12+
assert:
13+
hit_count: 3

0 commit comments

Comments
 (0)