Skip to content

Commit 6d3a087

Browse files
sekoia-io-cross-repo-comm-app[bot]github-actions[bot]
sekoia-io-cross-repo-comm-app[bot]
authored and
github-actions[bot]
committed
Refresh intakes documentation
1 parent accbeea commit 6d3a087

16 files changed

+2087
-54
lines changed

‎_shared_content/operations_center/integrations/generated/04d36706-ee4a-419b-906d-f92f3a46bcdd.md

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1397,6 +1397,54 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
13971397
```
13981398

13991399

1400+
=== "test_drive_sample3.json"
1401+
1402+
```json
1403+
1404+
{
1405+
"message": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-02-18T17:10:20.317Z\", \"uniqueQualifier\": \"-12345678\", \"applicationName\": \"drive\", \"customerId\": \"CUSTO1\"}, \"etag\": \"\\\"ABCDEF123\\\"\", \"actor\": {\"email\": \"\", \"profileId\": \"105250506097979753968\"}, \"events\": [{\"type\": \"access\", \"name\": \"sheets_import_range\", \"parameters\": [{\"name\": \"primary_event\", \"boolValue\": true}, {\"name\": \"billable\", \"boolValue\": false}, {\"name\": \"sheets_import_range_recipient_doc\", \"value\": \"123qwerty456\"}, {\"name\": \"owner_is_shared_drive\", \"boolValue\": true}, {\"name\": \"owner_team_drive_id\", \"value\": \"asdf678\"}, {\"name\": \"owner\", \"value\": \"johndoe\"}, {\"name\": \"doc_id\", \"value\": \"zxcv890\"}, {\"name\": \"doc_type\", \"value\": \"spreadsheet\"}, {\"name\": \"is_encrypted\", \"boolValue\": false}, {\"name\": \"doc_title\", \"value\": \"TPS report\"}, {\"name\": \"visibility\", \"value\": \"people_with_link\"}, {\"name\": \"shared_drive_id\", \"value\": \"asdf678\"}, {\"name\": \"actor_is_collaborator_account\", \"boolValue\": false}, {\"name\": \"owner_is_team_drive\", \"boolValue\": true}, {\"name\": \"team_drive_id\", \"value\": \"asdf678\"}]}]}",
1406+
"event": {
1407+
"action": "sheets_import_range",
1408+
"category": [
1409+
"file"
1410+
],
1411+
"dataset": "admin#reports#activity",
1412+
"type": [
1413+
"access"
1414+
]
1415+
},
1416+
"@timestamp": "2025-02-18T17:10:20.317000Z",
1417+
"cloud": {
1418+
"account": {
1419+
"id": "CUSTO1"
1420+
}
1421+
},
1422+
"file": {
1423+
"gid": "asdf678",
1424+
"name": "TPS report",
1425+
"owner": "johndoe",
1426+
"type": "spreadsheet"
1427+
},
1428+
"google": {
1429+
"report": {
1430+
"parameters": {
1431+
"visibility": "people_with_link"
1432+
}
1433+
}
1434+
},
1435+
"network": {
1436+
"application": "drive"
1437+
},
1438+
"related": {
1439+
"user": [
1440+
"johndoe"
1441+
]
1442+
}
1443+
}
1444+
1445+
```
1446+
1447+
14001448
=== "test_drive_view_document.json"
14011449

14021450
```json
@@ -1559,6 +1607,45 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
15591607
```
15601608

15611609

1610+
=== "test_groups_enterprise_1.json"
1611+
1612+
```json
1613+
1614+
{
1615+
"message": "{\"kind\": \"admin#reports#activity\", \"id\": {\"time\": \"2025-02-18T16:00:24.311Z\", \"uniqueQualifier\": \"-123456\", \"applicationName\": \"groups_enterprise\", \"customerId\": \"CUSTOMER1\"}, \"etag\": \"\\\"ABCDEF123\\\"\", \"actor\": {\"callerType\": \"KEY\", \"key\": \"SYSTEM\"}, \"events\": [{\"type\": \"moderator_action\", \"name\": \"remove_user\", \"parameters\": [{\"name\": \"member_id\", \"value\": \"[email protected]\"}, {\"name\": \"group_id\", \"value\": \"[email protected]\"}, {\"name\": \"member_type\", \"value\": \"user\"}]}, {\"type\": \"moderator_action\", \"name\": \"remove_member\", \"parameters\": [{\"name\": \"member_id\", \"value\": \"[email protected]\"}, {\"name\": \"group_id\", \"value\": \"[email protected]\"}, {\"name\": \"member_type\", \"value\": \"user\"}]}]}",
1616+
"event": {
1617+
"action": [
1618+
"remove_member",
1619+
"remove_user"
1620+
],
1621+
"category": [
1622+
"iam"
1623+
],
1624+
"dataset": "admin#reports#activity",
1625+
"type": [
1626+
"admin"
1627+
]
1628+
},
1629+
"@timestamp": "2025-02-18T16:00:24.311000Z",
1630+
"cloud": {
1631+
"account": {
1632+
"id": "CUSTOMER1"
1633+
}
1634+
},
1635+
"network": {
1636+
"application": "groups_enterprise"
1637+
},
1638+
"user": {
1639+
"email": "[email protected]",
1640+
"group": {
1641+
"id": "[email protected]"
1642+
}
1643+
}
1644+
}
1645+
1646+
```
1647+
1648+
15621649
=== "test_groups_entre_sample1.json"
15631650

15641651
```json

‎_shared_content/operations_center/integrations/generated/04d36706-ee4a-419b-906d-f92f3a46bcdd_sample.md

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1718,6 +1718,96 @@ In this section, you will find examples of raw logs as generated natively by the
17181718

17191719

17201720

1721+
=== "test_drive_sample3"
1722+
1723+
1724+
```json
1725+
{
1726+
"kind": "admin#reports#activity",
1727+
"id": {
1728+
"time": "2025-02-18T17:10:20.317Z",
1729+
"uniqueQualifier": "-12345678",
1730+
"applicationName": "drive",
1731+
"customerId": "CUSTO1"
1732+
},
1733+
"etag": "\"ABCDEF123\"",
1734+
"actor": {
1735+
"email": "",
1736+
"profileId": "105250506097979753968"
1737+
},
1738+
"events": [
1739+
{
1740+
"type": "access",
1741+
"name": "sheets_import_range",
1742+
"parameters": [
1743+
{
1744+
"name": "primary_event",
1745+
"boolValue": true
1746+
},
1747+
{
1748+
"name": "billable",
1749+
"boolValue": false
1750+
},
1751+
{
1752+
"name": "sheets_import_range_recipient_doc",
1753+
"value": "123qwerty456"
1754+
},
1755+
{
1756+
"name": "owner_is_shared_drive",
1757+
"boolValue": true
1758+
},
1759+
{
1760+
"name": "owner_team_drive_id",
1761+
"value": "asdf678"
1762+
},
1763+
{
1764+
"name": "owner",
1765+
"value": "johndoe"
1766+
},
1767+
{
1768+
"name": "doc_id",
1769+
"value": "zxcv890"
1770+
},
1771+
{
1772+
"name": "doc_type",
1773+
"value": "spreadsheet"
1774+
},
1775+
{
1776+
"name": "is_encrypted",
1777+
"boolValue": false
1778+
},
1779+
{
1780+
"name": "doc_title",
1781+
"value": "TPS report"
1782+
},
1783+
{
1784+
"name": "visibility",
1785+
"value": "people_with_link"
1786+
},
1787+
{
1788+
"name": "shared_drive_id",
1789+
"value": "asdf678"
1790+
},
1791+
{
1792+
"name": "actor_is_collaborator_account",
1793+
"boolValue": false
1794+
},
1795+
{
1796+
"name": "owner_is_team_drive",
1797+
"boolValue": true
1798+
},
1799+
{
1800+
"name": "team_drive_id",
1801+
"value": "asdf678"
1802+
}
1803+
]
1804+
}
1805+
]
1806+
}
1807+
```
1808+
1809+
1810+
17211811
=== "test_drive_view_document"
17221812

17231813

@@ -2212,6 +2302,66 @@ In this section, you will find examples of raw logs as generated natively by the
22122302

22132303

22142304

2305+
=== "test_groups_enterprise_1"
2306+
2307+
2308+
```json
2309+
{
2310+
"kind": "admin#reports#activity",
2311+
"id": {
2312+
"time": "2025-02-18T16:00:24.311Z",
2313+
"uniqueQualifier": "-123456",
2314+
"applicationName": "groups_enterprise",
2315+
"customerId": "CUSTOMER1"
2316+
},
2317+
"etag": "\"ABCDEF123\"",
2318+
"actor": {
2319+
"callerType": "KEY",
2320+
"key": "SYSTEM"
2321+
},
2322+
"events": [
2323+
{
2324+
"type": "moderator_action",
2325+
"name": "remove_user",
2326+
"parameters": [
2327+
{
2328+
"name": "member_id",
2329+
"value": "[email protected]"
2330+
},
2331+
{
2332+
"name": "group_id",
2333+
"value": "[email protected]"
2334+
},
2335+
{
2336+
"name": "member_type",
2337+
"value": "user"
2338+
}
2339+
]
2340+
},
2341+
{
2342+
"type": "moderator_action",
2343+
"name": "remove_member",
2344+
"parameters": [
2345+
{
2346+
"name": "member_id",
2347+
"value": "[email protected]"
2348+
},
2349+
{
2350+
"name": "group_id",
2351+
"value": "[email protected]"
2352+
},
2353+
{
2354+
"name": "member_type",
2355+
"value": "user"
2356+
}
2357+
]
2358+
}
2359+
]
2360+
}
2361+
```
2362+
2363+
2364+
22152365
=== "test_groups_entre_sample1"
22162366

22172367

‎_shared_content/operations_center/integrations/generated/07c0cac8-f68f-11ea-adc1-0242ac120002.md

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,78 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
9191
```
9292

9393

94+
=== "accept_ok_v5.json"
95+
96+
```json
97+
98+
{
99+
"message": "5 1234567890 eni-1235b8ca123456789 5.6.7.8 1.2.3.4 50188 4433 6 1 44 1739865042 1739865042 ACCEPT OK vpc-1 subnet-1 - 2 IPv4 5.6.7.8 1.2.3.4 eu-west-1 euw1-az2 - - - - ingress -",
100+
"event": {
101+
"category": [
102+
"network"
103+
],
104+
"end": "2025-02-18T07:50:42Z",
105+
"outcome": "ok",
106+
"start": "2025-02-18T07:50:42Z"
107+
},
108+
"@timestamp": "2025-02-18T07:50:42Z",
109+
"action": {
110+
"name": "accept",
111+
"outcome": "ok",
112+
"target": "network-traffic",
113+
"type": "forward"
114+
},
115+
"aws": {
116+
"flowlogs": {
117+
"subnet": {
118+
"id": "subnet-1"
119+
},
120+
"tcp_flags": 2,
121+
"vpc": {
122+
"id": "vpc-1"
123+
}
124+
}
125+
},
126+
"cloud": {
127+
"account": {
128+
"id": "1234567890"
129+
},
130+
"provider": "aws"
131+
},
132+
"destination": {
133+
"address": "1.2.3.4",
134+
"ip": "1.2.3.4",
135+
"port": 4433
136+
},
137+
"network": {
138+
"iana_number": "6",
139+
"transport": "tcp"
140+
},
141+
"observer": {
142+
"ingress": {
143+
"interface": {
144+
"name": "eni-1235b8ca123456789"
145+
}
146+
}
147+
},
148+
"related": {
149+
"ip": [
150+
"1.2.3.4",
151+
"5.6.7.8"
152+
]
153+
},
154+
"source": {
155+
"address": "5.6.7.8",
156+
"bytes": 44,
157+
"ip": "5.6.7.8",
158+
"packets": 1,
159+
"port": 50188
160+
}
161+
}
162+
163+
```
164+
165+
94166
=== "accept_structured.json"
95167

96168
```json
@@ -173,6 +245,17 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
173245
"target": "network-traffic",
174246
"type": "forward"
175247
},
248+
"aws": {
249+
"flowlogs": {
250+
"subnet": {
251+
"id": "subnet-aaaaaaaa012345678"
252+
},
253+
"tcp_flags": 0,
254+
"vpc": {
255+
"id": "vpc-abcdefab012345678"
256+
}
257+
}
258+
},
176259
"cloud": {
177260
"account": {
178261
"id": "424805057484"
@@ -300,6 +383,7 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
300383
"subnet": {
301384
"id": "subnet-0123456789abcdefg"
302385
},
386+
"tcp_flags": 3,
303387
"vpc": {
304388
"id": "vpc-0123456789abcdefg"
305389
}
@@ -518,6 +602,7 @@ The following table lists the fields that are extracted, normalized under the EC
518602
|`action.target` | `keyword` | The target of the action |
519603
|`action.type` | `keyword` | The type of the action |
520604
|`aws.flowlogs.subnet.id` | `keyword` | The ID of the subnet |
605+
|`aws.flowlogs.tcp_flags` | `number` | TCP flags |
521606
|`aws.flowlogs.vpc.id` | `keyword` | The ID of the VPC |
522607
|`cloud.account.id` | `keyword` | The cloud account or organization id. |
523608
|`cloud.instance.id` | `keyword` | Instance ID of the host machine. |

‎_shared_content/operations_center/integrations/generated/07c0cac8-f68f-11ea-adc1-0242ac120002_sample.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,15 @@ In this section, you will find examples of raw logs as generated natively by the
1313

1414

1515

16+
=== "accept_ok_v5"
17+
18+
19+
```json
20+
5 1234567890 eni-1235b8ca123456789 5.6.7.8 1.2.3.4 50188 4433 6 1 44 1739865042 1739865042 ACCEPT OK vpc-1 subnet-1 - 2 IPv4 5.6.7.8 1.2.3.4 eu-west-1 euw1-az2 - - - - ingress -
21+
```
22+
23+
24+
1625
=== "accept_structured"
1726

1827

0 commit comments

Comments
 (0)