diff --git a/packages/citrix_adc/changelog.yml b/packages/citrix_adc/changelog.yml index 1e52946b455..f43b4b7c73d 100644 --- a/packages/citrix_adc/changelog.yml +++ b/packages/citrix_adc/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.18.6" + changes: + - description: Fix ICASTART Grok pattern to handle empty customername (double space) and trailing carriage return characters. + type: bugfix + link: https://github.com/elastic/integrations/pull/20518 - version: "1.18.5" changes: - description: Fix parsing of Source/Destination IP, port, and byte counts for TCP CONN_TERMINATE events with trailing whitespace. diff --git a/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-native.json b/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-native.json index 32335198389..7e211bc4553 100644 --- a/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-native.json +++ b/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-native.json @@ -85,8 +85,8 @@ "message": "<134> 11/18/2024:10:59:53 GMT HOSTNAME 0-PPE-2 : default SSLVPN LOGOUT 6918043 0 : User UserName@domain.com - Client_ip 0.0.0.0 - Nat_ip \"Mapped Ip\" - Vserver 0.0.0.0:443 - Start_time \"11/18/2024:10:59:53 GMT\" - End_time \"11/18/2024:10:59:53 GMT\" - Duration 00:00:00 - Http_resources_accessed 0 - NonHttp_services_accessed 0 - Total_TCP_connections 0 - Total_UDP_flows 0 - Total_policies_allowed 0 - Total_policies_denied 0 - Total_bytes_send 0 - Total_bytes_recv 0 - Total_compressedbytes_send 0 - Total_compressedbytes_recv 0 - Compression_ratio_send 0.00% - Compression_ratio_recv 0.00% - LogoutMethod \"InternalError\" - Group(s) \"N/A\"\n" }, { - "@timestamp": "02/13/2025:19:47:20.000Z", - "message": "<135> 02/13/2025:19:47:20 GMT ECLVNSGP001 0-PPE-1 : default SSLVPN Message 877558 0 : \"\nclnt npcb is 12007a600, srvr is 12008be80\"" + "@timestamp": "02/13/2025:19:47:20.000Z", + "message": "<135> 02/13/2025:19:47:20 GMT ECLVNSGP001 0-PPE-1 : default SSLVPN Message 877558 0 : \"\nclnt npcb is 12007a600, srvr is 12008be80\"" } ] } diff --git a/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-rfc5424.json b/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-rfc5424.json index 05efa917807..06c66e52f46 100644 --- a/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-rfc5424.json +++ b/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-rfc5424.json @@ -9,7 +9,7 @@ "message": "<173>1 2025-01-30T12:00:00Z MY-CITRIX-HOST newsyslog 79382 - - logfile turned over due to size>100K" }, { - "@timestamp": "2025-01-08T13:30:00Z" , + "@timestamp": "2025-01-08T13:30:00Z", "message": "<171>1 2025-01-08T13:30:00Z MY-CITRIX-HOST httpd::authz_core 38137 - - [client 175.16.199.1:36664] AH01630: client denied by server configuration: /netscaler/ns_gui/var " }, { diff --git a/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log b/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log index 5f6833b53a2..d8fb88f0460 100644 --- a/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log +++ b/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log @@ -24,6 +24,7 @@ Oct 6 14:03:23 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : U Oct 6 14:03:23 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN LOGIN 4471 0 : User JohnDoe - Client_ip 192.168.1.50 - Nat_ip 10.0.0.50 - Vserver 1.128.0.0:443 - Browser_type "Chrome" - SSLVPN_client_type NetScalerPlugin - Group(s) "IT,RemoteWorkers" Oct 6 14:03:23 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN LOGOUT 4471 0 : User JaneSmith - Client_ip 192.168.1.51 - Nat_ip 10.0.0.51 - Vserver 1.128.0.0:10443 - Start_time "2023-04-01T08:00:00Z" - End_time "2023-04-01T12:00:00Z" - Duration 00:00:04 - Http_resources_accessed 15 - NonHttp_services_accessed 5 - Total_TCP_connections 20 - Total_UDP_flows 10 - Total_policies_allowed 25 - Total_policies_denied 5 - Total_bytes_send 1 - Total_bytes_recv 500 - Total_compressedbytes_send 700 - Total_compressedbytes_recv 350 - Compression_ratio_send 50.00% - Compression_ratio_recv 70.00% - LogoutMethod "Timeout" - Group(s) "HR,Finance" Oct 6 14:03:23 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN ICASTART 4471 0 : Source 192.168.1.52:5060 - Destination 1.128.0.0:80 - SSLRelayAddress 10.0.0.52:443 - customername AcmeCorp - username:domainname someusername:example.domain.com - applicationName WebMail - startTime "2023-04-01T09:00:00Z" - connectionId 9a8b7c +Oct 6 14:03:23 81.2.69.144 07/20/2026:15:59:08 GMT ns1 0-PPE-3 : default SSLVPN ICASTART 18346082 0 : Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime "07/20/2026:15:59:08 GMT" - connectionId 805bbd Oct 6 14:03:23 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN ICAEND_CONNSTAT 4471 0 : Source 192.168.1.53:22 - Destination 1.128.0.0:443 - SSLRelayAddress 10.0.0.53:443 - customername BetaInc - username:domainname someusername:example.domain.com - startTime "2023-04-01T09:00:00Z" - endTime "2023-04-01T09:45:00Z" - Duration 00:01:04 - Total_bytes_send 500000 - Total_bytes_recv 250000 - Total_compressedbytes_send 350000 - Total_compressedbytes_recv 175000 - Compression_ratio_send 50.00% - Compression_ratio_recv 70.00% - connectionId 1a2b3c Oct 6 14:03:23 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN TCPCONNSTAT 4471 0 : User AliceCooper - Client_ip 192.168.1.54 - Nat_ip 10.0.0.54 - Vserver 1.128.0.0:20443 - Source 192.168.1.55:443 - Destination 1.128.0.0:22 - Start_time "2023-04-01T10:00:00Z" - End_time "2023-04-01T11:00:00Z" - Duration 00:02:04 - Total_bytes_send 800000 - Total_bytes_recv 400000 - Total_compressedbytes_send 560000 - Total_compressedbytes_recv 280000 - Compression_ratio_send 70.00% - Compression_ratio_recv 70.00% - Access Full - Group(s) "Developers,QA" Oct 6 14:03:23 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN TCPCONN_TIMEDOUT 4471 0 : User CharlieBrown - Client_ip 192.168.1.56 - Nat_ip 10.0.0.56 - Vserver 1.128.0.0:10443 - Last_contact "2023-04-01T13:00:00Z" - Group(s) "Sales,Marketing" diff --git a/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json b/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json index d8d88e68b6d..860ea048eee 100644 --- a/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json +++ b/packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json @@ -2568,6 +2568,109 @@ "name": "someusername" } }, + { + "@timestamp": "2026-07-20T15:59:08.000Z", + "citrix": { + "cef_format": false, + "default_class": true, + "detail": "07/20/2026:15:59:08 GMT ns1 0-PPE-3 : default SSLVPN ICASTART 18346082 0 : Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime \"07/20/2026:15:59:08 GMT\" - connectionId 805bbd", + "device_event_class_id": "SSLVPN", + "extended": { + "message": "Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime \"07/20/2026:15:59:08 GMT\" - connectionId 805bbd" + }, + "facility": "local0", + "host": "ns1", + "name": "ICASTART", + "priority": "info" + }, + "citrix_adc": { + "log": { + "application_name": "WebApp-Desktop $P0000", + "connection_id": "805bbd", + "destination": { + "ip": "192.168.1.1", + "port": 80 + }, + "domain_name": "example", + "message": "Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime \"07/20/2026:15:59:08 GMT\" - connectionId 805bbd", + "source": { + "ip": "10.0.0.1", + "port": 12345 + }, + "ssl_relay": { + "address": "172.16.0.1", + "port": 443 + }, + "start_time": "2026-07-20T15:59:08.000Z", + "username": "user.name" + } + }, + "client": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "destination": { + "ip": "192.168.1.1", + "port": 80 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "authentication" + ], + "id": "18346082", + "kind": "event", + "original": "Oct 6 14:03:23 81.2.69.144 07/20/2026:15:59:08 GMT ns1 0-PPE-3 : default SSLVPN ICASTART 18346082 0 : Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime \"07/20/2026:15:59:08 GMT\" - connectionId 805bbd", + "severity": 0, + "start": "2026-07-20T15:59:08.000Z", + "timezone": "GMT", + "type": [ + "info" + ] + }, + "observer": { + "hostname": "ns1", + "product": "Netscaler", + "type": "firewall", + "vendor": "Citrix" + }, + "related": { + "ip": [ + "10.0.0.1", + "192.168.1.1", + "81.2.69.144", + "172.16.0.1" + ], + "user": [ + "user.name" + ] + }, + "source": { + "ip": "10.0.0.1", + "port": 12345 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "domain": "example", + "name": "user.name" + } + }, { "@timestamp": "2014-10-06T14:03:23.000Z", "citrix": { diff --git a/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 6d4994b4ca2..61f838b72b1 100644 --- a/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -27,7 +27,7 @@ processors: tag: remove_newlines field: event.original ignore_missing: true - pattern: "\n" + pattern: "[\r\n]" replacement: "" - grok: description: Extract header details and message from log line. diff --git a/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/sslvpn_and_aaatm_feature.yml b/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/sslvpn_and_aaatm_feature.yml index e54efb174e7..aaceac31193 100644 --- a/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/sslvpn_and_aaatm_feature.yml +++ b/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/sslvpn_and_aaatm_feature.yml @@ -42,7 +42,7 @@ processors: if: 'ctx.citrix.name == "ICASTART"' field: citrix.extended.message patterns: - - '^Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - SSLRelayAddress %{IP:citrix_adc.log.ssl_relay.address}:%{INT:citrix_adc.log.ssl_relay.port} - customername( %{WORD:citrix_adc.log.customer_name})? - username:domainname %{DATA:citrix_adc.log.username}:%{DATA:citrix_adc.log.domain_name} - applicationName %{DATA:citrix_adc.log.application_name} - startTime "%{DATA:_tmp.start_time}" - connectionId %{WORD:citrix_adc.log.connection_id} ?$' + - '^Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - SSLRelayAddress %{IP:citrix_adc.log.ssl_relay.address}:%{INT:citrix_adc.log.ssl_relay.port} - customername(?:%{SPACE}%{WORD:citrix_adc.log.customer_name})?%{SPACE}- username:domainname %{DATA:citrix_adc.log.username}:%{DATA:citrix_adc.log.domain_name} - applicationName %{DATA:citrix_adc.log.application_name} - startTime "%{DATA:_tmp.start_time}" - connectionId %{WORD:citrix_adc.log.connection_id}%{SPACE}$' - '^%{DATA} Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - customername (%{WORD:citrix_adc.log.customer_name})? - username:domainname %{DATA:citrix_adc.log.username}:%{DATA:citrix_adc.log.domain_name} - applicationName %{DATA:citrix_adc.log.application_name} - startTime "%{DATA:_tmp.start_time}" - connectionId %{WORD:citrix_adc.log.connection_id} ?$' - grok: diff --git a/packages/citrix_adc/manifest.yml b/packages/citrix_adc/manifest.yml index fb7e5a346c7..560b837bf25 100644 --- a/packages/citrix_adc/manifest.yml +++ b/packages/citrix_adc/manifest.yml @@ -1,7 +1,7 @@ format_version: "3.0.2" name: citrix_adc title: Citrix ADC -version: "1.18.5" +version: "1.18.6" description: This Elastic integration collects logs and metrics from Citrix ADC product. type: integration categories: