microsoft-sentinel-logstash-output 1.2.0 → 1.2.1

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: f3314cd9fbec5bd71add1de243e0474739dfe43aa1bd7a498c316066681306d8
4
- data.tar.gz: 8ddab05b2acceb5d15a051b5134ccb7ea12b6efb22fb1712192d1a00bfac60ff
3
+ metadata.gz: ac705f936fb73ea295c27fec409200028e41a9696981d55649af26f0f7193125
4
+ data.tar.gz: c9dae4e13cfcb6e976c0beeba976fb2c3fbb732b70f2e7237cb7b8d4fdea4169
5
5
  SHA512:
6
- metadata.gz: efafed55777a2757fb3c1416b8bbf6e4e8653fd45cd08a26bda22d997a7dd9aac4624b7d5854df24e4de9f50deed4d1d1c8cadf69aab9e4197d8219615416db6
7
- data.tar.gz: 0b75c805e3e640df6cfcdcdc6646ee2e158b9c2c5c0c5caa1b24f2823270d70b0e148df76207d94508440f0877aa5b6c2a9111a6a8a79b7a3e166eab94106661
6
+ metadata.gz: aa7ba8571ed03795e83a37f8fc4b2f7ecb4176dcaf9f4ea0fd4a1c9c15876c1a6c118cca82f1abe2d26504a66a6388be6af91e7f163adf15ab8621423c5cf966
7
+ data.tar.gz: 6fd78bdec65594be688813a11870a00412bcfc0d9cab9bb92dade9d318b639cdb1b5c646c9cb8fb60c61235eae6060849efc6cc90453d1d537c95e90833a676d
data/CHANGELOG.md CHANGED
@@ -1,7 +1,7 @@
1
1
  ## 1.0.0
2
2
  * Initial release for output plugin for logstash to Microsoft Sentinel. This is done with the Log Analytics DCR based API.
3
3
 
4
- ## 1.1.0
4
+ ## 1.1.0
5
5
  * Increase timeout for read/open connections to 120 seconds.
6
6
  * Add error handling for when connection timeout occurs.
7
7
  * Upgrade the rest-client dependency minimum version to 2.1.0.
@@ -14,4 +14,5 @@
14
14
  * Increase timeout for read/open connections to 240 seconds.
15
15
 
16
16
  ## 1.2.0
17
- * Added support for Managed Identity authentication on both Azure VMs and Azure Arc connected machines.
17
+ * Added support for Managed Identity authentication on both Azure VMs and Azure Arc connected machines.
18
+ * * Rename the plugin to microsoft-sentinel-log-analytics-logstash-output
data/README.md CHANGED
@@ -38,10 +38,10 @@ sudo apt-mark hold logstash
38
38
 
39
39
  Please note that when using Logstash 8, it is recommended to disable ECS in the pipeline. For more information refer to [Logstash documentation.](<https://www.elastic.co/guide/en/logstash/8.4/ecs-ls.html>)
40
40
 
41
- To install the microsoft-sentinel-log-analytics-logstash-output-plugin, you can make use of the published gem at rubygems.com:
41
+ To install the microsoft-sentinel-log-analytics-logstash-output, you can make use of the published gem at rubygems.com:
42
42
 
43
43
  ```
44
- sudo /usr/share/logstash/bin/logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin
44
+ sudo /usr/share/logstash/bin/logstash-plugin install microsoft-sentinel-log-analytics-logstash-output
45
45
  ```
46
46
 
47
47
  If your machine doesn't has an active Internet connection, or you want to install the plugin manually, you can download the plugin files and perform an 'offline' installation. [Logstash Offline Plugin Management instruction](<https://www.elastic.co/guide/en/logstash/current/offline-plugins.html>).
@@ -49,7 +49,7 @@ If your machine doesn't has an active Internet connection, or you want to instal
49
49
  If you already have the plugin installed, you can check which version you have by running:
50
50
 
51
51
  ```
52
- sudo /usr/share/logstash/bin/logstash-plugin list --verbose microsoft-sentinel-log-analytics-logstash-output-plugin
52
+ sudo /usr/share/logstash/bin/logstash-plugin list --verbose microsoft-sentinel-log-analytics-logstash-output
53
53
  ```
54
54
 
55
55
  ## 2. Create a sample file
@@ -57,7 +57,7 @@ To create a sample file, follow the following steps:
57
57
  1) Copy the output plugin configuration below to your Logstash configuration file:
58
58
  ```
59
59
  output {
60
- microsoft-sentinel-log-analytics-logstash-output-plugin {
60
+ microsoft-sentinel-log-analytics-logstash-output {
61
61
  create_sample_file => true
62
62
  sample_file_path => "<enter the path to the file in which the sample data will be written>" #for example: "c:\\temp" (for windows) or "/var/log" for Linux.
63
63
  }
@@ -84,7 +84,7 @@ input {
84
84
  }
85
85
 
86
86
  output {
87
- microsoft-sentinel-log-analytics-logstash-output-plugin {
87
+ microsoft-sentinel-log-analytics-logstash-output {
88
88
  create_sample_file => true
89
89
  sample_file_path => "<enter the path to the file in which the sample data will be written>" #for example: "c:\\temp" (for windows) or "/var/log" for Linux.
90
90
  }
@@ -127,7 +127,7 @@ Here is an example for the output plugin configuration section:
127
127
 
128
128
  ```
129
129
  output {
130
- microsoft-sentinel-log-analytics-logstash-output-plugin {
130
+ microsoft-sentinel-log-analytics-logstash-output {
131
131
  client_app_Id => "<enter your client_app_id value here>"
132
132
  client_app_secret => "<enter your client_app_secret value here>"
133
133
  tenant_id => "<enter your tenant id here>"
@@ -160,7 +160,7 @@ Here is an example for the output plugin configuration section using a Managed I
160
160
 
161
161
  ```
162
162
  output {
163
- microsoft-sentinel-log-analytics-logstash-output-plugin {
163
+ microsoft-sentinel-log-analytics-logstash-output {
164
164
  managed_identity => true
165
165
  data_collection_endpoint => "<enter your DCE logsIngestion URI here>"
166
166
  dcr_immutable_id => "<enter your DCR immutableId here>"
@@ -192,7 +192,7 @@ input {
192
192
  filter {
193
193
  }
194
194
  output {
195
- microsoft-sentinel-log-analytics-logstash-output-plugin {
195
+ microsoft-sentinel-log-analytics-logstash-output {
196
196
  client_app_Id => "619c1731-15ca-4403-9c61-xxxxxxxxxxxx"
197
197
  client_app_secret => "xxxxxxxxxxxxxxxx"
198
198
  tenant_id => "72f988bf-86f1-41af-91ab-xxxxxxxxxxxx"
@@ -216,7 +216,7 @@ input {
216
216
  filter {
217
217
  }
218
218
  output {
219
- microsoft-sentinel-log-analytics-logstash-output-plugin {
219
+ microsoft-sentinel-log-analytics-logstash-output {
220
220
  client_app_Id => "619c1731-15ca-4403-9c61-xxxxxxxxxxxx"
221
221
  client_app_secret => "xxxxxxxxxxxxxxxx"
222
222
  tenant_id => "72f988bf-86f1-41af-91ab-xxxxxxxxxxxx"
@@ -236,7 +236,7 @@ input {
236
236
  }
237
237
 
238
238
  output {
239
- microsoft-sentinel-log-analytics-logstash-output-plugin {
239
+ microsoft-sentinel-log-analytics-logstash-output {
240
240
  client_app_Id => "${CLIENT_APP_ID}"
241
241
  client_app_secret => "${CLIENT_APP_SECRET}"
242
242
  tenant_id => "${TENANT_ID}"
data/SECURITY.md ADDED
@@ -0,0 +1,32 @@
1
+ # Security Policy
2
+
3
+ ## Supported Versions
4
+
5
+ The following versions are currently being supported with security updates.
6
+
7
+ | Version | Supported |
8
+ | ------- | ------------------ |
9
+ | 1.2.0 | :white_check_mark: |
10
+ | < 1.2.0 | :x: |
11
+
12
+ ## Reporting a Vulnerability
13
+
14
+ We take security very seriously. If you have discovered a security vulnerability in our project, we appreciate your help in disclosing it to us in a responsible manner.
15
+
16
+ **Here's how you can report a vulnerability:**
17
+
18
+ 1. Send an email to our security team at [security@xxx.com](mailto:security@xxx.com). If possible, please use a descriptive subject line.
19
+
20
+ 2. Include as much information as possible about the vulnerability. This may include the steps to reproduce, the potential impact, and any proposed fixes or workarounds.
21
+
22
+ 3. Do not disclose the vulnerability publicly until we've had a chance to address it.
23
+
24
+ **What to expect after reporting a vulnerability:**
25
+
26
+ 1. Confirmation of receipt: Within 3 business days of your report, we aim to acknowledge that we've received your report. We'll also attempt to confirm the vulnerability if it's not immediately obvious.
27
+
28
+ 2. Regular updates: Every 5 business days, we'll send you an email updating you on the status of your report. This may include confirmation of the vulnerability, details of any fixes or workarounds, and an estimated timeline for a fix.
29
+
30
+ 3. Public disclosure: Once we've addressed the vulnerability, we'll make a public announcement. If you wish, we can acknowledge your contribution in this announcement.
31
+
32
+ Please note that we will respect your privacy and will only use your personal information to correspond with you about this report.
@@ -8,7 +8,7 @@ require "logstash/sentinel_la/logsSender"
8
8
 
9
9
  class LogStash::Outputs::MicrosoftSentinelOutput < LogStash::Outputs::Base
10
10
 
11
- config_name "microsoft-sentinel-log-analytics-logstash-output-plugin"
11
+ config_name "microsoft-sentinel-log-analytics-logstash-output"
12
12
 
13
13
  # Stating that the output plugin will run in concurrent mode
14
14
  concurrency :shared
@@ -92,9 +92,9 @@ class LogstashLoganalyticsOutputConfiguration
92
92
 
93
93
 
94
94
  def print_missing_parameter_message_and_raise(param_name)
95
- @logger.error("Missing a required setting for the microsoft-sentinel-log-analytics-logstash-output-plugin output plugin:
95
+ @logger.error("Missing a required setting for the microsoft-sentinel-log-analytics-logstash-output output plugin:
96
96
  output {
97
- microsoft-sentinel-log-analytics-logstash-output-plugin {
97
+ microsoft-sentinel-log-analytics-logstash-output {
98
98
  #{param_name} => # SETTING MISSING
99
99
  ...
100
100
  }
@@ -1,10 +1,10 @@
1
1
  module LogStash; module Outputs;
2
2
  class MicrosoftSentinelOutputInternal
3
- VERSION_INFO = [1, 2, 0].freeze
3
+ VERSION_INFO = [1, 2, 1].freeze
4
4
  VERSION = VERSION_INFO.map(&:to_s).join('.').freeze
5
5
 
6
6
  def self.version
7
7
  VERSION
8
8
  end
9
9
  end
10
- end;end
10
+ end;end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: microsoft-sentinel-logstash-output
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.2.0
4
+ version: 1.2.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Pouyan & Koos
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2024-04-12 00:00:00.000000000 Z
11
+ date: 2024-04-16 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rest-client
@@ -84,6 +84,7 @@ files:
84
84
  - Gemfile
85
85
  - LICENSE
86
86
  - README.md
87
+ - SECURITY.md
87
88
  - code_of_conduct.md
88
89
  - lib/logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin.rb
89
90
  - lib/logstash/sentinel_la/customSizeBasedBuffer.rb
@@ -99,7 +100,7 @@ files:
99
100
  - lib/logstash/sentinel_la/logstashLoganalyticsConfiguration.rb
100
101
  - lib/logstash/sentinel_la/sampleFileCreator.rb
101
102
  - lib/logstash/sentinel_la/version.rb
102
- - microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec
103
+ - microsoft-sentinel-log-analytics-logstash-output.gemspec
103
104
  homepage: https://github.com/pkhabazi/microsoft-sentinel-logstash-output
104
105
  licenses:
105
106
  - MIT