Skip to content

Added support for collecting audit logs via API #13972

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

kevinmata92
Copy link
Contributor

Proposed commit message

Added support for collecting audit logs from Turbine via the audit logs API endpoint.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • Linting / Test

How to test this PR locally

  • Run system test
  • Can provide a cloud instance if needed to setup the integration if needed.

Screenshots

image

@kevinmata92 kevinmata92 requested a review from a team as a code owner May 23, 2025 00:23
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason to use HTTP JSON here? We would prefer to move to CEL if there is no concrete reason to use this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was not aware of that one. I'll get it switched over and fixed. Thank you!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you

vars:
preserve_original_event: true
assert:
hit_count: 1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add final new line.

Also, testing should exercise pagination; at least a first, middle and end page, with the first and middle having more than one event.

]
}
`}}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

show_user: false
description: >-
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

@@ -7,4 +7,4 @@ data_stream:
symlinks: false

assert:
hit_count: 1
hit_count: 1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Final new line and pagination.

@@ -7,4 +7,4 @@ data_stream:
symlinks: false

assert:
hit_count: 1
hit_count: 1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Final new line and pagination.

@@ -7,4 +7,4 @@ data_stream:
symlinks: false

assert:
hit_count: 1
hit_count: 1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Final new line and pagination.

@andrewkroh andrewkroh added Integration:swimlane Swimlane Turbine (Community supported) Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels May 23, 2025
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Integration:swimlane Swimlane Turbine (Community supported) Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants