Skip to content

Commit c61905c

Browse files
aaarone90aaarone90
committed
Adding Amazon Network Firewall Integration
Signed-off-by: Aaron Alvarez <[email protected]>
1 parent 66e1316 commit c61905c

19 files changed

+2665
-0
lines changed

‎server/adaptors/integrations/__data__/repository/.DS_Store

6 KB
Binary file not shown.

‎server/adaptors/integrations/__data__/repository/amazon_networkfirewall/.DS_Store

6 KB
Binary file not shown.

‎server/adaptors/integrations/__data__/repository/amazon_networkfirewall/amazon_networkfirewall-1.0.0.json

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
{
2+
"name": "amazon_networkfirewall",
3+
"version": "1.0.0",
4+
"displayName": "Amazon Network Firewall",
5+
"description": "Monitor flow logs and alerts from AWS Network Firewall.",
6+
"license": "Apache-2.0",
7+
"type": "logs_amazon_networkfirewall",
8+
"labels": ["Observability", "Logs", "AWS", "Cloud", "S3 Glue"],
9+
"author": "OpenSearch",
10+
"sourceUrl": "https://github.com/opensearch-project/opensearch-catalog/releases/tag/amazon_vpc_flow_1.1.0",
11+
"workflows": [
12+
{
13+
"name": "queries",
14+
"label": "Queries (recommended)",
15+
"description": "Tables and pre-written queries for quickly getting insights on your data.",
16+
"enabled_by_default": true
17+
},
18+
{
19+
"name": "dashboards",
20+
"label": "Dashboards & Visualizations",
21+
"description": "Dashboards and indices that enable you to easily visualize important metrics.",
22+
"enabled_by_default": false
23+
}
24+
],
25+
"statics": {
26+
"logo": {
27+
"annotation": "AWS Network Firewall Logo",
28+
"path": "logo.svg"
29+
},
30+
"gallery": [
31+
{
32+
"annotation": "AWS Network Firewall Dashboard",
33+
"path": "dashboard.png"
34+
},
35+
{
36+
"annotation": "AWS Network Firewall Dashboard",
37+
"path": "dashboard1.png"
38+
},
39+
{
40+
"annotation": "AWS Network Firewall Dashboard",
41+
"path": "dashboard2.png"
42+
},
43+
{
44+
"annotation": "AWS Network Firewall Dashboard",
45+
"path": "dashboard3.png"
46+
}
47+
]
48+
},
49+
"components": [
50+
{
51+
"name": "amazon_networkfirewall",
52+
"version": "1.0.0"
53+
},
54+
{
55+
"name": "cloud",
56+
"version": "1.0.0"
57+
},
58+
{
59+
"name": "logs_amazon_networkfirewall",
60+
"version": "1.0.0"
61+
}
62+
],
63+
"assets": [
64+
{
65+
"name": "amazon_networkfirewall",
66+
"version": "1.0.0",
67+
"extension": "ndjson",
68+
"type": "savedObjectBundle",
69+
"workflows": ["dashboards"]
70+
},
71+
{
72+
"name": "example_queries",
73+
"version": "1.0.0",
74+
"extension": "ndjson",
75+
"type": "savedObjectBundle",
76+
"workflows": ["queries"]
77+
},
78+
{
79+
"name": "create_table",
80+
"version": "1.0.0",
81+
"extension": "sql",
82+
"type": "query"
83+
},
84+
{
85+
"name": "create_skipping_index",
86+
"version": "1.0.0",
87+
"extension": "sql",
88+
"type": "query",
89+
"workflows": ["queries"]
90+
},
91+
{
92+
"name": "create_mv",
93+
"version": "1.0.0",
94+
"extension": "sql",
95+
"type": "query",
96+
"workflows": ["dashboards"]
97+
}
98+
],
99+
"sampleData": {
100+
"path": "sample.json"
101+
}
102+
}
103+

‎server/adaptors/integrations/__data__/repository/amazon_networkfirewall/assets/amazon_networkfirewall-1.0.0.ndjson

Lines changed: 49 additions & 0 deletions
Large diffs are not rendered by default.

‎server/adaptors/integrations/__data__/repository/amazon_networkfirewall/assets/create_mv-1.0.0.sql

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
CREATE MATERIALIZED VIEW {table_name}__mview AS
2+
SELECT
3+
/* General log info */
4+
firewall_name AS `aws.networkfirewall.firewall_name`,
5+
/* General event info */
6+
CAST( event.timestamp AS TIMESTAMP) AS `aws.networkfirewall.event.timestamp`,
7+
event.src_ip AS `aws.networkfirewall.event.src_ip`,
8+
event.src_port AS `aws.networkfirewall.event.src_port`,
9+
event.dest_ip AS `aws.networkfirewall.event.dest_ip`,
10+
event.dest_port AS `aws.networkfirewall.event.dest_port`,
11+
event.proto AS `aws.networkfirewall.event.proto`,
12+
event.app_proto AS `aws.networkfirewall.event.app_proto`,
13+
/* TCP Events info */
14+
event.tcp.tcp_flags AS `aws.networkfirewall.event.tcp.tcp_flags`,
15+
event.tcp.syn AS `aws.networkfirewall.event.tcp.syn`,
16+
event.tcp.ack AS `aws.networkfirewall.event.tcp.ack`,
17+
/* Alert events info */
18+
event.alert.action AS `aws.networkfirewall.event.alert.action`,
19+
event.alert.signature_id AS `aws.networkfirewall.event.alert.signature_id`,
20+
event.alert.signature AS `aws.networkfirewall.event.alert.signature`,
21+
/* HTTP events info */
22+
event.http.hostname AS `aws.networkfirewall.event.http.hostname`,
23+
event.http.url AS `aws.networkfirewall.event.http.url`,
24+
event.http.http_user_agent AS `aws.networkfirewall.event.http.http_user_agent`,
25+
/* TLS Events info */
26+
event.tls.sni AS `aws.networkfirewall.event.tls.sni`,
27+
/* Netflow Events info */
28+
event.netflow.pkts AS `aws.networkfirewall.event.netflow.pkts`,
29+
event.netflow.bytes AS `aws.networkfirewall.event.netflow.bytes`,
30+
event.netflow.age AS `aws.networkfirewall.event.netflow.age`
31+
FROM
32+
{table_name}
33+
WITH (
34+
auto_refresh = true,
35+
refresh_interval = '15 Minute',
36+
checkpoint_location = '{s3_checkpoint_location}',
37+
watermark_delay = '1 Minute'
38+
)

‎server/adaptors/integrations/__data__/repository/amazon_networkfirewall/assets/create_mv_aggregated-1.0.0 copy.sql

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
CREATE MATERIALIZED VIEW {table_name}__mview AS
2+
SELECT
3+
TUMBLE(`@timestamp`, '5 Minute').start AS `aws.networkfirewall.event.timestamp`,
4+
firewall_name AS `aws.networkfirewall.firewall_name`,
5+
event_src_ip AS `aws.networkfirewall.event.src_ip`,
6+
event_src_port AS `aws.networkfirewall.event.src_port`,
7+
event_dest_ip AS `aws.networkfirewall.event.dest_ip`,
8+
event_dest_port AS `aws.networkfirewall.event.dest_port`,
9+
event_proto AS `aws.networkfirewall.event.proto`,
10+
event_app_proto AS `aws.networkfirewall.event.app_proto`,
11+
event_tcp_tcp_flags AS `aws.networkfirewall.event.tcp.tcp_flags`,
12+
event_tcp_syn AS `aws.networkfirewall.event.tcp.syn`,
13+
event_tcp_ack AS `aws.networkfirewall.event.tcp.ack`,
14+
event_alert_action AS `aws.networkfirewall.event.alert.action`,
15+
event_alert_signature_id AS `aws.networkfirewall.event.alert.signature_id`,
16+
event_alert_signature AS `aws.networkfirewall.event.alert.signature`,
17+
event_http_hostname AS `aws.networkfirewall.event.http.hostname`,
18+
event_http_url AS `aws.networkfirewall.event.http.url`,
19+
event_http_http_user_agent AS `aws.networkfirewall.event.http.http_user_agent`,
20+
event_tls_sni AS `aws.networkfirewall.event.tls.sni`,
21+
/* Aggregations */
22+
SUM(CAST(event_netflow_bytes AS BIGINT)) AS `aws.networkfirewall.total_bytes`,
23+
SUM(CAST(event_netflow_pkts AS BIGINT)) AS `aws.networkfirewall.event.netflow.pkts`,
24+
AVG(CAST(event_netflow_age AS DOUBLE)) AS `aws.networkfirewall.event.netflow.age`,
25+
COUNT(*) AS `aws.networkfirewall.total_count`
26+
FROM (
27+
SELECT
28+
CAST(event.timestamp AS TIMESTAMP) AS `@timestamp`,
29+
firewall_name AS `firewall_name`,
30+
event.src_ip AS `event_src_ip`,
31+
event.src_port AS `event_src_port`,
32+
event.dest_ip AS `event_dest_ip`,
33+
event.dest_port AS `event_dest_port`,
34+
event.proto AS `event_proto`,
35+
event.app_proto AS `event_app_proto`,
36+
event.tcp.tcp_flags AS `event_tcp_tcp_flags`,
37+
event.tcp.syn AS `event_tcp_syn`,
38+
event.tcp.ack AS `event_tcp_ack`,
39+
event.alert.action AS `event_alert_action`,
40+
event.alert.signature_id AS `event_alert_signature_id`,
41+
event.alert.signature AS `event_alert_signature`,
42+
event.http.hostname AS `event_http_hostname`,
43+
event.http.url AS `event_http_url`,
44+
event.http.http_user_agent AS `event_http_http_user_agent`,
45+
event.tls.sni AS `event_tls_sni`,
46+
event.netflow.pkts AS `event_netflow_pkts`,
47+
event.netflow.bytes AS `event_netflow_bytes`,
48+
event.netflow.age AS `event_netflow_age`
49+
FROM
50+
{table_name}
51+
)
52+
GROUP BY
53+
TUMBLE(`@timestamp`, '5 Minute'),
54+
firewall_name,
55+
event_src_ip,
56+
event_src_port,
57+
event_dest_ip,
58+
event_dest_port,
59+
event_proto,
60+
event_app_proto,
61+
event_tcp_tcp_flags,
62+
event_tcp_syn,
63+
event_tcp_ack,
64+
event_alert_action,
65+
event_alert_signature_id,
66+
event_alert_signature,
67+
event_http_hostname,
68+
event_http_url,
69+
event_http_http_user_agent,
70+
event_tls_sni
71+
WITH (
72+
auto_refresh = true,
73+
refresh_interval = '15 Minute',
74+
watermark_delay = '1 Minute',
75+
checkpoint_location = '{s3_checkpoint_location}'
76+
);

‎server/adaptors/integrations/__data__/repository/amazon_networkfirewall/assets/create_skipping_index-1.0.0.sql

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
CREATE SKIPPING INDEX ON {table_name} (
2+
`event.src_ip` BLOOM_FILTER,
3+
`event.dest_ip` BLOOM_FILTER,
4+
`event.proto` VALUE_SET,
5+
`event.alert.severity` VALUE_SET,
6+
`event.event_type` VALUE_SET,
7+
`firewall_name` VALUE_SET,
8+
`availability_zone` VALUE_SET
9+
) WITH (
10+
auto_refresh = true,
11+
refresh_interval = '15 Minutes',
12+
checkpoint_location = '{s3_checkpoint_location}',
13+
watermark_delay = '1 Minute'
14+
)

0 commit comments

Comments
 (0)