Skip to content

Pleasant Password Server extraction improvements #15666

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 14 commits into from
Oct 23, 2025
Merged

Pleasant Password Server extraction improvements #15666

merged 14 commits into from
Oct 23, 2025

Conversation

@WildDogOne
Copy link
Contributor

@WildDogOne WildDogOne commented Oct 16, 2025 •
edited
Loading

Proposed commit message

Improvements to the extraction of logfiles from the pleasant password server.
Added new proprietary pps fields for password entry information eg. username in a password entry changed (not to be confused with the username of a person who initiated the change)

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

I have noticed that the logfiles have a maybe important inforamtion after "changing the".
For example:

  • changing the name
  • changing the expiry date

I propose to extract this information.
But grok is not a good option for this since these values are very dynamic hence would make a huge list of groks for every possible case.
Maybe someone could ruby script this for me?
Or any other cool ideas?

<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - [email protected] -  - Success - Entry Updated - User <[email protected]> updated entry <TOP/SECRET/PASSWORD> changing the name from <PASSWORD> to <PASSWORD2> changing the username from <entry_username> to <entry_username2> changing the password changing the notes changing the expiry date from <> to <2027-09-23 00:00>
<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - [email protected] -  - Success - Entry Updated - User <[email protected]> updated entry <TOP/SECRET/PASSWORD> changing the username from <entry_username> to <entry_username2> changing the password changing the expiry date from <> to <2027-10-02 08:00>

There is also an error message in the build that does not seem to stem from this pull request:

2025/10/16 12:41:57  INFO Skipped errors: found 1 validation error:
   1. references found in dashboard kibana/dashboard/pps-66ae8483-4391-4554-a223-11e5c6c98653.json: pps-e1373589-225f-4d6e-8751-fc846f726b10 (search) (SVR00004)

@andrewkroh andrewkroh added Integration:pps Pleasant Password Server (Community supported) documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels Oct 16, 2025
@WildDogOne WildDogOne marked this pull request as ready for review October 16, 2025 12:05
@WildDogOne WildDogOne requested a review from a team as a code owner October 16, 2025 12:05
@andrewkroh andrewkroh added the Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] label Oct 16, 2025
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6
efd6 reviewed Oct 16, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you provide a reference for the changes here?

@WildDogOne
Copy link
Contributor Author

Can you provide a reference for the changes here?

I am not quite sure what you mean.
The changes are basically adding more extractions so that the data is more usable compared to the past :)

@efd6
Copy link
Contributor

efd6 commented Oct 19, 2025

I am not quite sure what you mean.
The changes are basically adding more extractions so that the data is more usable compared to the past :)

The changes depend on an understanding of the expected layout of the data. It would be nice to have a reference for that for future maintenance.

@WildDogOne
Copy link
Contributor Author

WildDogOne commented Oct 20, 2025 •
edited
Loading

We have added the following fields and why:
(I hope this helps)

event.reason:
https://www.elastic.co/docs/reference/ecs/ecs-event#field-event-reason
We would like to fill this field with the reason on why an event triggered.
Before now that data was in the message field, so it was available but not really searchable.
Examples: Entry Created, Entry Duplicated, Sign-in Failed
When we talk about "Entry" in the context of the application "Pleasant Password Server" we mean a password element inside of the password server. This is quite important to understand the custom fields we added

pps.*
We added this as an object that holds all Pleasant Password Server specific fields because we where not able to find a proper mapping to ECS.
Of course if you have ideas for mapping, we are open to them since we prefer ECS to custom fields.

pps.entry.*
We added the entry object which should hold all the information about what en Entry is or what happened to an Entry. We tried to make it similar to for example the ECS field "user"
Important is that as stated before, "Entry" is the name that the Pleasant Password Server uses to describe a Password Object in the database.

pps.entry.path
We added Path so that the Path of where an Entry is situated can be extracted into it.

pps.entry.reason
We added Reason so that the reason for, for example a modification of an Entry can be extracted into it.
Reason is not often seen in logs though.

pps.entry.name
This is the name of an "Entry" that was accessed or modified, deleted etc.

pps.entry.target.name
This field is only relevant on changes to the name of an "Entry"
It is very similar to user.name and user.target.name in function.
Hence this field always comes together with the old name of an entry (pps.entry.name) and the new one.

pps.entry.username
This field is a bit difficult to understand, this is not the User who is accessing or modifying an "Entry" but the username of that password entry in the password safe.
So it will almost always differ from user.name

pps.entry.target.username
This field just like pps.entry.target.name is only relevant on changes, but this time to the username within an "Entry"

Why we didn't put all the entry information directly into pps.* is basically to anticipate that maybe in the future other fields could become important that would not mix well with the entry fields.

@efd6
Copy link
Contributor

efd6 commented Oct 20, 2025

Is there a reference for the field syntax in the log lines that we are consuming?

@WildDogOne
Copy link
Contributor Author

Maybe this will help:
https://pleasantpasswords.com/info/pleasant-password-server/g-logging/audit-log-contents

@efd6
Copy link
Contributor

efd6 commented Oct 22, 2025

Thanks, that's good. There are two outstanding review comments, then I can run the tests.

@WildDogOne
Copy link
Contributor Author

I resolved them, I hope they where committed as well, but I didn't have a commit button on them

@efd6
Copy link
Contributor

efd6 commented Oct 22, 2025

They are resolved, but unchanged. I'll do it.

efd6
efd6 reviewed Oct 22, 2025
View reviewed changes
@efd6
Copy link
Contributor

efd6 commented Oct 22, 2025

/test

@efd6
Copy link
Contributor

efd6 commented Oct 22, 2025

/test

@elastic-vault-github-plugin-prod
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@efd6
Copy link
Contributor

efd6 commented Oct 23, 2025

/test

@elasticmachine
Copy link

💚 Build Succeeded

History

efd6
efd6 approved these changes Oct 23, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@efd6 efd6 merged commit ffa4ed6 into elastic:main Oct 23, 2025
7 checks passed
@elastic-vault-github-plugin-prod
Copy link

Package pps - 1.1.0 containing this change is available at https://epr.elastic.co/package/pps/1.1.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@efd6 efd6 efd6 approved these changes

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:pps Pleasant Password Server (Community supported) Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@WildDogOne @elasticmachine @efd6 @andrewkroh