You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "Laurens Vets (JIRA)" <ji...@apache.org> on 2018/01/22 18:32:01 UTC
[jira] [Commented] (METRON-1415) match statement does not seem to
work.
[ https://issues.apache.org/jira/browse/METRON-1415?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16334698#comment-16334698 ]
Laurens Vets commented on METRON-1415:
--------------------------------------
Forgot to attach a sample event:
{code:java}
{
"_index": "cloudtrail_index_2018.01.19.19",
"_type": "cloudtrail_doc",
"_id": "353dc770-7e7f-4adb-a26c-47489ee53850",
"_score": null,
"_timestamp": 1516389108923,
"_source": {
"eventID": "903778b5-b2f1-47da-be7f-eaf5338d4bc3",
"adapter:stellaradapter:end:ts": "1516389108930",
"threatinteljoinbolt:joiner:ts": "1516389108939",
"eventVersion": "1.05",
"sourceIPAddress": "ec2.amazonaws.com",
"eventSource": "sts.amazonaws.com",
"enrichmentsplitterbolt:splitter:begin:ts": "1516389108928",
"enrichmentjoinbolt:joiner:ts": "1516389108932",
"AWSEventSourceAccount": "Unknown Account.",
"source:type": "cloudtrail",
"original_string": "{\"eventVersion\":\"1.05\",\"userIdentity\":{\"type\":\"AWSService\",\"invokedBy\":\"ec2.amazonaws.com\"},\"eventTime\":\"2018-01-19T19:01:52Z\",\"eventSource\":\"sts.amazonaws.com\",\"eventName\":\"AssumeRole\",\"awsRegion\":\"eu-central-1\",\"sourceIPAddress\":\"ec2.amazonaws.com\",\"userAgent\":\"ec2.amazonaws.com\",\"requestParameters\":{\"roleSessionName\":\"i-0b2c026849d02eda0\",\"roleArn\":\"arn:aws:iam::<AWS_ID>:role/consul_server003c3a221a00eaf436cf9067f4\"},\"responseElements\":{\"credentials\":{\"sessionToken\":\"<SESSION_TOKEN>\",\"accessKeyId\":\"<ACCESS_KEY>\",\"expiration\":\"Jan 20, 2018 1:20:40 AM\"}},\"requestID\":\"20100e98-7482-4c42-bcc7-ca603f9a8d95\",\"eventID\":\"903778b5-b2f1-47da-be7f-eaf5338d4bc3\",\"resources\":[{\"ARN\":\"arn:aws:iam::<AWS_ID>:role/consul_server003c3a221a00eaf436cf9067f4\",\"accountId\":\"<AWS_ID>\",\"type\":\"AWS::IAM::Role\"}],\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"<AWS_ID>\",\"sharedEventID\":\"5ff74aae-d741-47ac-a340-8916a462037b\"}",
"sharedEventID": "5ff74aae-d741-47ac-a340-8916a462037b",
"eventTime": "2018-01-19T19:01:52Z",
"eventName": "AssumeRole",
"recipientAccountId": "<AWS_ID>",
"responseElements:credentials:sessionToken": "<SESSION_TOKEN>",
"responseElements:credentials:expiration": "Jan 20, 2018 1:20:40 AM",
"threatintelsplitterbolt:splitter:end:ts": "1516389108934",
"timestamp": 1516389108923,
"requestParameters:roleSessionName": "i-0b2c026849d02eda0",
"awsRegion": "eu-central-1",
"is_sap": false,
"enrichmentsplitterbolt:splitter:end:ts": "1516389108928",
"resources": [
{
"accountId": "<AWS_ID>",
"type": "AWS::IAM::Role",
"ARN": "arn:aws:iam::<AWS_ID>:role/consul_server003c3a221a00eaf436cf9067f4"
}
],
"userAgent": "ec2.amazonaws.com",
"adapter:stellaradapter:begin:ts": "1516389108930",
"eventType": "AwsApiCall",
"userIdentity:invokedBy": "ec2.amazonaws.com",
"userIdentity:type": "AWSService",
"requestParameters:roleArn": "arn:aws:iam::<AWS_ID>:role/consul_server003c3a221a00eaf436cf9067f4",
"requestID": "20100e98-7482-4c42-bcc7-ca603f9a8d95",
"responseElements:credentials:accessKeyId": "<ACCESS_KEY>",
"threatintelsplitterbolt:splitter:begin:ts": "1516389108934",
"guid": "353dc770-7e7f-4adb-a26c-47489ee53850"
},
"fields": {
"adapter:stellaradapter:end:ts": [
1516389108930
],
"threatinteljoinbolt:joiner:ts": [
1516389108939
],
"enrichmentsplitterbolt:splitter:end:ts": [
1516389108928
],
"enrichmentsplitterbolt:splitter:begin:ts": [
1516389108928
],
"enrichmentjoinbolt:joiner:ts": [
1516389108932
],
"adapter:stellaradapter:begin:ts": [
1516389108930
],
"eventTime": [
1516388512000
],
"threatintelsplitterbolt:splitter:begin:ts": [
1516389108934
],
"threatintelsplitterbolt:splitter:end:ts": [
1516389108934
],
"timestamp": [
1516389108923
]
},
"sort": [
1516389108923
]
}{code}
> match statement does not seem to work.
> --------------------------------------
>
> Key: METRON-1415
> URL: https://issues.apache.org/jira/browse/METRON-1415
> Project: Metron
> Issue Type: Bug
> Affects Versions: 0.4.2
> Reporter: Laurens Vets
> Priority: Major
>
> I had the following code in my Sensor Enrichment Config:
> {code:java}
> {
> "enrichment": {
> "fieldMap": {
> "stellar": {
> "config": {
> "AWSEventSourceAccount": "match{recipientAccountID == 1111111111L => 'account1', recipientAccountID == 2222222222L => 'account2', recipientAccountID == 333333333L => 'account3', recipientAccountID == 4444444444L => 'account4', recipientAccountID == 5555555555L => 'account4', recipientAccountID == 6666666666L => 'account6', default => 'Unknown Account.'}"
> }
> }
> },
> "fieldToTypeMap": {},
> "config": {}
> },{code}
> However, this did not work as expected and the AWSEventSourceAccount field would always return "Unknown Account" in my events.
> According to [~ottobackwards], this does work in the Stellar shell. He asked me to test with "_source.recipientAccountID" instead of "recipientAccountID" and make sure that mapStrategy is set to UNFOLD (this was already the case).
> However, using this in my enrichment config does not resolve the issue. I used:
> {code:java}
> {
> "enrichment": {
> "fieldMap": {
> "stellar": {
> "config": {
> "AWSEventSourceAccount": "match{_source.recipientAccountID == 1111111111L => 'account1', _source.recipientAccountID == 2222222222L => 'account2', _source.recipientAccountID == 333333333L => 'account3', _source.recipientAccountID == 4444444444L => 'account4', _source.recipientAccountID == 5555555555L => 'account4', _source.recipientAccountID == 6666666666L => 'account6', default => 'Unknown Account.'}"
> }
> }
> },
> "fieldToTypeMap": {},
> "config": {}
> },{code}
>
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)