Merge pull request #1988 from SEKOIA-IO/update-intake-documentation

Refresh intakes documentation
SEKOIA-IO · Sep 20, 2024 · 181791b · 181791b
2 parents 686a1bc + ef11eb8
commit 181791b
Show file tree

Hide file tree

Showing 40 changed files with 4,557 additions and 1,298 deletions.
diff --git a/...perations_center/integrations/generated/07c0cac8-f68f-11ea-adc1-0242ac120002.md b/...perations_center/integrations/generated/07c0cac8-f68f-11ea-adc1-0242ac120002.md
@@ -274,6 +274,76 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
 	```
 
 
+=== "network_traffic.json"
+
+    ```json
+
+    {
+        "message": "{\"version\":5,\"account_id\":\"012345678901\",\"interface_id\":\"eni-1235b8ca123456789\",\"srcaddr\":\"1.2.3.4\",\"dstaddr\":\"5.6.7.8\",\"srcport\":25238.0,\"dstport\":8080.0,\"protocol\":6.0,\"packets\":5.0,\"bytes\":412.0,\"start\":1726491185,\"end\":1726491211,\"action\":\"ACCEPT\",\"log_status\":\"OK\",\"vpc_id\":\"vpc-0123456789abcdefg\",\"subnet_id\":\"subnet-0123456789abcdefg\",\"instance_id\":\"-\",\"tcp_flags\":3.0,\"type\":\"IPv4\",\"pkt_srcaddr\":\"1.2.3.4\",\"pkt_dstaddr\":\"5.6.7.8\",\"region\":\"eu-west-1\",\"az_id\":\"euw1-az3\",\"sublocation_type\":\"-\",\"sublocation_id\":\"-\",\"pkt_src_aws_service\":\"-\",\"pkt_dst_aws_service\":\"-\",\"flow_direction\":\"ingress\",\"traffic_path\":null}",
+        "event": {
+            "category": [
+                "network"
+            ],
+            "end": "2024-09-16T12:53:31Z",
+            "outcome": "ok",
+            "start": "2024-09-16T12:53:05Z"
+        },
+        "@timestamp": "2024-09-16T12:53:05Z",
+        "action": {
+            "name": "accept",
+            "outcome": "ok",
+            "target": "network-traffic",
+            "type": "forward"
+        },
+        "aws": {
+            "flowlogs": {
+                "subnet": {
+                    "id": "subnet-0123456789abcdefg"
+                },
+                "vpc": {
+                    "id": "vpc-0123456789abcdefg"
+                }
+            }
+        },
+        "cloud": {
+            "account": {
+                "id": "012345678901"
+            },
+            "provider": "aws"
+        },
+        "destination": {
+            "address": "5.6.7.8",
+            "ip": "5.6.7.8",
+            "port": 8080.0
+        },
+        "network": {
+            "iana_number": "6.0"
+        },
+        "observer": {
+            "ingress": {
+                "interface": {
+                    "name": "eni-1235b8ca123456789"
+                }
+            }
+        },
+        "related": {
+            "ip": [
+                "1.2.3.4",
+                "5.6.7.8"
+            ]
+        },
+        "source": {
+            "address": "1.2.3.4",
+            "bytes": 412.0,
+            "ip": "1.2.3.4",
+            "packets": 5.0,
+            "port": 25238.0
+        }
+    }
+    	
+	```
+
+
 === "nodata.json"
 
     ```json
@@ -447,7 +517,10 @@ The following table lists the fields that are extracted, normalized under the EC
 |`action.outcome` | `keyword` | The outcome of the action |
 |`action.target` | `keyword` | The target of the action |
 |`action.type` | `keyword` | The type of the action |
+|`aws.flowlogs.subnet.id` | `keyword` | The ID of the subnet |
+|`aws.flowlogs.vpc.id` | `keyword` | The ID of the VPC |
 |`cloud.account.id` | `keyword` | The cloud account or organization id. |
+|`cloud.instance.id` | `keyword` | Instance ID of the host machine. |
 |`cloud.provider` | `keyword` | Name of the cloud provider. |
 |`destination.ip` | `ip` | IP address of the destination. |
 |`destination.port` | `long` | Port of the destination. |

diff --git a/...ns_center/integrations/generated/07c0cac8-f68f-11ea-adc1-0242ac120002_sample.md b/...ns_center/integrations/generated/07c0cac8-f68f-11ea-adc1-0242ac120002_sample.md
@@ -55,6 +55,45 @@ In this section, you will find examples of raw logs as generated natively by the
 
 
 
+=== "network_traffic"
+
+
+    ```json
+	{
+        "version": 5,
+        "account_id": "012345678901",
+        "interface_id": "eni-1235b8ca123456789",
+        "srcaddr": "1.2.3.4",
+        "dstaddr": "5.6.7.8",
+        "srcport": 25238.0,
+        "dstport": 8080.0,
+        "protocol": 6.0,
+        "packets": 5.0,
+        "bytes": 412.0,
+        "start": 1726491185,
+        "end": 1726491211,
+        "action": "ACCEPT",
+        "log_status": "OK",
+        "vpc_id": "vpc-0123456789abcdefg",
+        "subnet_id": "subnet-0123456789abcdefg",
+        "instance_id": "-",
+        "tcp_flags": 3.0,
+        "type": "IPv4",
+        "pkt_srcaddr": "1.2.3.4",
+        "pkt_dstaddr": "5.6.7.8",
+        "region": "eu-west-1",
+        "az_id": "euw1-az3",
+        "sublocation_type": "-",
+        "sublocation_id": "-",
+        "pkt_src_aws_service": "-",
+        "pkt_dst_aws_service": "-",
+        "flow_direction": "ingress",
+        "traffic_path": null
+    }
+    ```
+
+
+
 === "nodata"
 
 

diff --git a/...perations_center/integrations/generated/07c556c0-0675-478c-9803-e7990afe78b6.md b/...perations_center/integrations/generated/07c556c0-0675-478c-9803-e7990afe78b6.md
@@ -753,6 +753,11 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
         "organization": {
             "id": "123456789831564686"
         },
+        "related": {
+            "user": [
+                "user.name"
+            ]
+        },
         "rule": {
             "id": "-1"
         },
@@ -788,6 +793,9 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
             "eventid": 1387019684138751044,
             "siteId": 1083054176741832911,
             "updatedAt": "2022-03-29T17:20:30.998054Z"
+        },
+        "user": {
+            "name": "user.name"
         }
     }
     	
@@ -1310,7 +1318,7 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
                 "2001:db8:85a3::8a2e:370:7334"
             ],
             "user": [
-                "VM-SENTINELONE\\User"
+                "User"
             ]
         },
         "sentinelone": {
@@ -1459,7 +1467,8 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
             }
         },
         "user": {
-            "name": "VM-SENTINELONE\\User"
+            "domain": "VM-SENTINELONE",
+            "name": "User"
         }
     }
     	
@@ -1531,7 +1540,7 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
                 "fe80::9ddd:fd78:1f21:f709"
             ],
             "user": [
-                "tdr-vm-template\\tdr"
+                "tdr"
             ]
         },
         "sentinelone": {
@@ -1688,7 +1697,8 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
             }
         },
         "user": {
-            "name": "tdr-vm-template\\tdr"
+            "domain": "tdr-vm-template",
+            "name": "tdr"
         }
     }
     	
@@ -1758,7 +1768,7 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
                 "fe80::e4a1:7fce:33f3:d50e"
             ],
             "user": [
-                "DOMAIN\\USERNAME"
+                "USERNAME"
             ]
         },
         "sentinelone": {
@@ -2067,7 +2077,8 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
             }
         },
         "user": {
-            "name": "DOMAIN\\USERNAME"
+            "domain": "DOMAIN",
+            "name": "USERNAME"
         }
     }
     	
@@ -2133,7 +2144,7 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
                 "66.66.66.66"
             ],
             "user": [
-                "DOMAIN\\USERNAME"
+                "USERNAME"
             ]
         },
         "sentinelone": {
@@ -2441,7 +2452,8 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
             }
         },
         "user": {
-            "name": "DOMAIN\\USERNAME"
+            "domain": "DOMAIN",
+            "name": "USERNAME"
         }
     }
     	
@@ -2887,6 +2899,7 @@ The following table lists the fields that are extracted, normalized under the EC
 |`threat.indicator.file.size` | `long` | File size in bytes. |
 |`threat.software.type` | `keyword` | Software type. |
 |`url.original` | `wildcard` | Unmodified original url as seen in the event source. |
+|`user.domain` | `keyword` | Name of the directory the user is a member of. |
 |`user.id` | `long` |  |
 |`user.name` | `keyword` | Short name or login of the user. |