Skip to content

[Azure] Update ECS field mappings for firewall_logs data stream #16395

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
moxarth-rathod wants to merge 4 commits into
base: main
Choose a base branch
from
Open

[Azure] Update ECS field mappings for firewall_logs data stream #16395

moxarth-rathod wants to merge 4 commits into from
+404 −19

Conversation

@moxarth-rathod
Copy link
Contributor

@moxarth-rathod moxarth-rathod commented Dec 8, 2025 •
edited
Loading

Proposed commit message

azure: update ECS field mappings for firewall_logs data stream that includes the following changes
- add `destination.ip` to `destination.address` and `source.ip` to `source.address`.
- add `TranslatedIp` and `TranslatedPort` to `destination.nat.ip` and `destination.nat.port`.
- update event type mappings for AZFWNetworkRule and AZFWApplicationRule categories in firewall_logs data stream.
- remove `destination.ip` and `destination.port` mapping of `TranslatedIp` and `TranslatedPort`.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

@moxarth-rathod moxarth-rathod self-assigned this Dec 8, 2025
@moxarth-rathod moxarth-rathod requested a review from a team as a code owner December 8, 2025 08:56
@moxarth-rathod moxarth-rathod added the enhancement New feature or request label Dec 8, 2025
@moxarth-rathod moxarth-rathod requested review from a team as code owners December 8, 2025 08:56
@moxarth-rathod moxarth-rathod added Integration:azure Azure Logs Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Dec 8, 2025
@elasticmachine
Copy link

elasticmachine commented Dec 8, 2025

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Dec 8, 2025 •
edited
Loading

🚀 Benchmarks report

Package azure 👍(5) 💚(1) 💔(6)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
provisioning 6802.72 3003 -3799.72 (-55.86%) 💔
application_gateway 3311.26 2785.52 -525.74 (-15.88%) 💔
auditlogs 3861 1960.78 -1900.22 (-49.22%) 💔
eventhub 1e+06 333333.33 -666666.67 (-66.67%) 💔
firewall_logs 2008.03 1386.96 -621.07 (-30.93%) 💔
identity_protection 4545.45 3496.5 -1048.95 (-23.08%) 💔

To see the full report comment with /test benchmark fullreport

ShourieG
ShourieG reviewed Dec 10, 2025
View reviewed changes
kcreddy
kcreddy reviewed Dec 10, 2025
View reviewed changes
packages/azure/data_stream/firewall_logs/elasticsearch/ingest_pipeline/default.yml
Comment on lines 85 to 100
- rename:
field: json.properties.TranslatedPort
target_field: destination.port
ignore_missing: true
ignore_failure: true
if: ctx?.azure?.firewall?.properties?.DestinationPort == null
- set:
field: destination.nat.port
tag: set_destination_nat_port_from_properties_translated_port
copy_from: json.properties.TranslatedPort
ignore_empty_value: true
Copy link
Contributor

@kcreddy kcreddy Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

kcreddy
kcreddy reviewed Dec 10, 2025
View reviewed changes
@elasticmachine
Copy link

elasticmachine commented Dec 12, 2025

💚 Build Succeeded

History

cc @moxarth-rathod

ShourieG
ShourieG approved these changes Dec 12, 2025
View reviewed changes
Copy link
Contributor

@ShourieG ShourieG left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM from my end but please wait for @kcreddy

kcreddy
kcreddy approved these changes Dec 12, 2025
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks @moxarth-rathod !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kcreddy kcreddy kcreddy approved these changes

@ShourieG ShourieG ShourieG approved these changes

Assignees

@moxarth-rathod moxarth-rathod

Labels

enhancement New feature or request Integration:azure Azure Logs Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Azure Logs]: Firewall events not capturing *.address

4 participants

@moxarth-rathod @elasticmachine @kcreddy @ShourieG