[Filebeat][GSuite] Initial implementation of SAML and User Accounts filesets #19329
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
marc-gr
added
enhancement
in progress
|
Pinging @elastic/siem (Team:SIEM) |
botelastic
bot
added
needs_team
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
|
marc-gr
force-pushed
the
feature_filebeat_gsuite
branch
from
68fe137 to
dd80383
Compare
marc-gr
changed the title
marc-gr
force-pushed
the
feature_filebeat_gsuite
branch
2 times, most recently
from
4af96b3 to
f558ba5
Compare
andrewkroh
reviewed
Jun 26, 2020
marc-gr
force-pushed
the
feature_filebeat_gsuite
branch
3 times, most recently
from
d43792e to
1e391e5
Compare
marc-gr
added
review
and removed
in progress
marc-gr
force-pushed
the
feature_filebeat_gsuite
branch
from
1e391e5 to
9544599
Compare
marc-gr
force-pushed
the
feature_filebeat_gsuite
branch
3 times, most recently
from
c34f88e to
24fd4e6
Compare
leehinman
requested changes
Jul 2, 2020
x-pack/filebeat/module/gsuite/saml/test/gsuite-saml-test.json.log-expected.json
Outdated
Show resolved
Hide resolved
andrewstucki
reviewed
Jul 2, 2020
x-pack/filebeat/module/gsuite/saml/test/gsuite-saml-test.json.log-expected.json
Outdated
Show resolved
Hide resolved
marc-gr
force-pushed
the
feature_filebeat_gsuite
branch
from
24fd4e6 to
5d94306
Compare
andrewstucki
reviewed
Jul 3, 2020
marc-gr
force-pushed
the
feature_filebeat_gsuite
branch
from
0e5c307 to
e66f25e
Compare
andrewstucki
approved these changes
Jul 6, 2020
There was a problem hiding this comment.
I'm good with this, but it'd be nice if @leehinman or @andrewkroh could sign off on the updated changes
8 tasks
marc-gr
added a commit
to marc-gr/beats
that referenced
this pull request
Jul 14, 2020
…ilesets (elastic#19329) * GSuite initial implementation of SAML fileset * Document fields and generate test file * Add documentation * Split fields and improve docs * Add change to CHANGELOG * Rename config file and clean docs * Adds user accounts fileset * Add delegated user to google oauth * Add types and make changes to common pipeline * Do not stop input if array key not found * Fix docs * Setup for date cursor * Add beta tag * CHANGELOG message * Improve ECS mappings * Change cateogrization and types of various fields * Change event.type to start * Improve doc references (cherry picked from commit 7abd67d)
marc-gr
added a commit
that referenced
this pull request
Jul 15, 2020
…ilesets (#19329) (#19726) * GSuite initial implementation of SAML fileset * Document fields and generate test file * Add documentation * Split fields and improve docs * Add change to CHANGELOG * Rename config file and clean docs * Adds user accounts fileset * Add delegated user to google oauth * Add types and make changes to common pipeline * Do not stop input if array key not found * Fix docs * Setup for date cursor * Add beta tag * CHANGELOG message * Improve ECS mappings * Change cateogrization and types of various fields * Change event.type to start * Improve doc references (cherry picked from commit 7abd67d)
melchiormoulin
pushed a commit
to melchiormoulin/beats
that referenced
this pull request
Oct 14, 2020
…ilesets (elastic#19329) * GSuite initial implementation of SAML fileset * Document fields and generate test file * Add documentation * Split fields and improve docs * Add change to CHANGELOG * Rename config file and clean docs * Adds user accounts fileset * Add delegated user to google oauth * Add types and make changes to common pipeline * Do not stop input if array key not found * Fix docs * Setup for date cursor * Add beta tag * CHANGELOG message * Improve ECS mappings * Change cateogrization and types of various fields * Change event.type to start * Improve doc references
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR adds a GSuite module to filebeat that uses
httpjsonas input, and creates a SAML and User accounts filesets for it, which consumes events from https://developers.google.com/admin-sdk/reports/v1/appendix/activity/[saml|user-accounts]Why is it important?
It is the first step to allow users to consume
gsuiteactivity reports. It sets the common pieces for the next filesets and since SAML and User accounts are the simplest ones makes it easy to test and validate the module functionality.Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Author's Checklist
Depends on
#19246