Skip to content

Commit 337ca9b

Browse files
authored
CRTX-164822-Infoblox (demisto#41834)
* changed parsing and modeling rules * added release notes * added tags and usecases * metadata * metadata * metadata
1 parent cd394a8 commit 337ca9b

4 files changed

Lines changed: 50 additions & 63 deletions

File tree

Packs/Infoblox/ModelingRules/Infoblox_1_3/Infoblox_1_3.xif

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ filter _raw_log ~= "(?:UDP|TCP):\s*query:\s*(?:\S+\s+){3}response:"
130130
/**************/
131131
// DHCP Events /
132132
/*************/
133-
filter _raw_log ~= "(?:dhcpd|omshell|dhcrelay|dhclient)\[\d+\]" or _raw_log ~= "DHCP\w+"
133+
filter _raw_log ~= "(?:dhcpd|omshell|dhcrelay|dhclient)\[\d+\]" or (_raw_log ~= "DHCP\w+" and _raw_log !~= "(?:UDP|TCP):\s*query:\s*(?:\S+\s+){3}response:")
134134
| alter // Extract syslog headers & syslog message
135135
syslog_process_id = arrayindex(regextract(_raw_log, "\s\w+\[(\d+)\]"), 0),
136136
syslog_process_name = arrayindex(regextract(_raw_log, "\s(\w+)\[\d+\]"), 0),
Lines changed: 35 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,41 @@
11
[INGEST:vendor="infoblox", product="infoblox", target_dataset="infoblox_infoblox_raw", no_hit=keep]
22
/*
3-
This filter applies to DNS Queries & Responses events, which contain an internal timestamp within the syslog message.
4-
It supports timestamp ingestion for the following timestamp format: <dd-mmm-YYYY HH:MM:SS.uuu>.
5-
For example: "18-Jan-2024 13:03:44.821".
6-
The timestamp is interpreted in a GMT+0 timezone.
7-
See https://docs.infoblox.com/space/nios85/35816694/Capturing+DNS+Queries+and+Responses for additional details.
8-
*/
9-
filter _raw_log ~= "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}"
10-
| alter tmp_timestamp_string = arrayindex(regextract(_raw_log, "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}"), 0)
11-
| alter _time = parse_timestamp("%d-%b-%Y %H:%M:%E3S", tmp_timestamp_string)
12-
| fields - tmp_timestamp_string; // Remove the temporary utility field
3+
This parsing rule normalizes timestamps from Infoblox logs that may include one of three
4+
supported timestamp formats, extracted into the following variables:
135

14-
/*
15-
This filter applies to syslog messages that are sent to Cortex XSIAM from Infoblox directly (Excluding DNS Queries & Responses events),
16-
as opposed to event logs which are downloaded to a file and sent to Cortex XSIAM indirectly via an intermediate syslog client.
17-
It supports timestamp ingestion in the following formats <Mmm dd hh:mm:ss>
18-
where Mmm is the English language abbreviation for the month of the year with the first character in uppercase and the other two
19-
characters in lowercase, and dd is the day of the month, where if the day of the month is less
20-
than 10, then it MUST be represented as a space and then the number, as in the RFC 3164 timestamp format.
21-
For example: "Jan 9 21:30:48" or "Jan 18 21:30:48".
22-
The timestamp is interpreted in a GMT+0 timezone, and the year is derived from current year.
23-
*/
24-
filter // Exclude DNS Queries & Responses events timestamp format
25-
_raw_log !~= "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}" and _raw_log ~= "\<\d+\>\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2}\s+"
26-
| alter // Extract current year and raw timestamp
27-
tmp_current_year = to_string(format_timestamp("%Y",current_time())),
28-
tmp_raw_timestamp_string = arrayindex(regextract( _raw_log, "\<\d+\>(\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2})\s+"), 0)
29-
| alter // Reformat the raw timestamp representation with current year
30-
tmp_current_year_timestamp_string = concat(tmp_current_year, " ", tmp_raw_timestamp_string)
31-
| alter // Convert the timestamp string representation to datetime format
32-
tmp_current_year_timestamp_datetime = parse_timestamp("%Y %b %e %H:%M:%S", tmp_current_year_timestamp_string)
33-
| alter // Check if the calculated date is in the future (due to year transitioning during log ingestion )
34-
tmp_time_difference = timestamp_diff(tmp_current_year_timestamp_datetime, current_time(), "MILLISECOND")
35-
| alter // Calculate previous year if necessary
36-
tmp_previous_year = if(tmp_time_difference > 0, to_string(subtract(to_integer(tmp_current_year), 1)), null)
37-
| alter // Adjust timestamp to previous year if required
38-
tmp_previous_year_timestamp_string = if(tmp_previous_year != null, concat(tmp_previous_year, " ", tmp_raw_timestamp_string), null)
39-
| alter // Converts the previous year string representation to datetime format
40-
tmp_previous_year_timestamp_datetime = if(tmp_previous_year_timestamp_string != null, parse_timestamp("%Y %b %e %H:%M:%S", tmp_previous_year_timestamp_string), null)
41-
| alter // Set to the relevant timestamp
42-
_time = coalesce(tmp_previous_year_timestamp_datetime, tmp_current_year_timestamp_datetime)
43-
| fields - tmp*; // Remove all temporary util fields
6+
1) tmp_dns_timestamp
7+
• Applies to DNS Queries & Responses events that contain an internal timestamp
8+
within the syslog message payload.
9+
• Format: <dd-Mmm-YYYY HH:MM:SS.uuu>
10+
Example: "18-Jan-2024 13:03:44.821"
11+
• Timezone: Interpreted as GMT+0 (UTC).
12+
• Reference: https://docs.infoblox.com/space/nios85/35816694/Capturing+DNS+Queries+and+Responses
4413

45-
/*
46-
This filter applies to other syslog messages that are sent to Cortex XSIAM indirectly via an intermediate syslog client,
47-
which is compatible with RFC5424. For example if the logs from Infoblox are downloaded to a file,
48-
and an intermediate syslog process then reads these records and forwards them to Cortex XSIAM.
49-
It Supports RFC 5424 compatible timestamps format, which include a seconds fraction precision.
50-
For example: "2023-10-29T11:18:59.123Z", or "2023-10-29T11:18:59.123456-06:00".
51-
The timezone is extracted from the RFC5424 timestamp.
14+
2) tmp_direct_timestamp
15+
• Applies to syslog messages sent directly from Infoblox (excluding DNS Q/R).
16+
• Format: <Mmm dd hh:mm:ss> — RFC 3164 style (no year, no timezone).
17+
Examples: "Jan 9 21:30:48", "Jan 18 21:30:48"
18+
• Timezone: Interpreted as GMT+0 (UTC).
19+
• Year: Derived from the current year.
20+
21+
3) tmp_syslog_timestamp
22+
• Applies to syslog messages sent indirectly via an intermediate syslog client
23+
that uses RFC 5424-compatible formatting.
24+
• Formats:
25+
"YYYY-MM-DDThh:mm:ss.sssZ"
26+
"YYYY-MM-DDThh:mm:ss.ssssss±HH:MM"
27+
Examples: "2023-10-29T11:18:59.123Z", "2023-10-29T11:18:59.123456-06:00"
28+
• Timezone: Extracted directly from the timestamp (Z normalized to +00:00).
29+
30+
The parser selects the most appropriate timestamp in this order of precedence:
31+
1) DNS (application event time)
32+
2) RFC 5424 (header time with timezone)
33+
3) Direct Infoblox (RFC 3164 style, derived year)
5234
*/
53-
filter // Exclude DNS Queries & Responses events timestamp format and Infoblox syslog messages timestamp format
54-
_raw_log ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\.\d+([+-]\d{2}:\d{2}|Z)" and _raw_log !~= "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}" and _raw_log !~= "\<\d+\>\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2}\s+"
55-
| alter tmp_raw_timestamp = arrayindex(regextract(_raw_log, "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\S+"), 0)
56-
| alter tmp_timestamp = replace(to_string(tmp_raw_timestamp), "Z", "+00:00") // normalize zulu time timezone to a numeric offset
57-
| alter tmp_precision = arrayindex(regextract(tmp_timestamp, "\.(\d{1,6})"), 0)
58-
| alter tmp_precision_length = len(tmp_precision)
59-
| alter tmp_time = if( // adjust parsing format according to the precision length
60-
tmp_precision_length = 1, parse_timestamp("%FT%H:%M:%E1S%Ez", tmp_timestamp),
61-
tmp_precision_length = 2, parse_timestamp("%FT%H:%M:%E2S%Ez", tmp_timestamp),
62-
tmp_precision_length = 3, parse_timestamp("%FT%H:%M:%E3S%Ez", tmp_timestamp),
63-
tmp_precision_length = 6, parse_timestamp("%FT%H:%M:%E6S%Ez", tmp_timestamp))
64-
| alter _time = tmp_time
35+
filter _raw_log ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\.\d+([+-]\d{2}:\d{2}|Z)" or _raw_log ~= "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}" or _raw_log ~= "\<\d+\>\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2}\s+"
36+
| alter tmp_current_year = to_string(format_timestamp("%Y",current_time()))
37+
| alter tmp_dns_timestamp = arrayindex(regextract(_raw_log, "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}"), 0),
38+
tmp_direct_timestamp = concat(tmp_current_year, " ", arrayindex(regextract( _raw_log, "\<\d+\>(\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2})\s+"), 0)),
39+
tmp_syslog_timestamp = replace(arrayindex(regextract(_raw_log, "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\S+"), 0), "Z", "+00:00") // normalize zulu time timezone to a numeric offset
40+
| alter _time = if(tmp_dns_timestamp != null and tmp_dns_timestamp != "", parse_timestamp("%d-%b-%Y %H:%M:%E*S", tmp_dns_timestamp) , tmp_syslog_timestamp!= null and tmp_syslog_timestamp != "",parse_timestamp("%FT%H:%M:%E*S%Ez", tmp_syslog_timestamp), tmp_direct_timestamp != null and tmp_direct_timestamp != "", parse_timestamp("%Y %b %e %H:%M:%S", tmp_direct_timestamp))
6541
| fields - tmp*; // Remove all temporary util fields
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#### Modeling Rules
2+
3+
##### Infoblox Modeling Rules
4+
5+
- Updated the Infoblox Modeling Rules modeling rule to improve event type mapping.
6+
7+
#### Parsing Rules
8+
9+
##### Infoblox Parsing Rule
10+
11+
- Updated the Infoblox Parsing Rule parsing rule to fix a minor issue with timestamp extraction.

Packs/Infoblox/pack_metadata.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,16 @@
22
"name": "Infoblox NIOS",
33
"description": "Infoblox is a comprehensive solution that consolidates DNS, DHCP, and IP address management into a single platform. It is designed to simplify network management by automating these critical functions and providing a centralized console for managing them.",
44
"support": "partner",
5-
"currentVersion": "1.1.12",
5+
"currentVersion": "1.1.13",
66
"author": "Infoblox Inc.",
77
"url": "https://support.infoblox.com/",
88
"email": "support@infoblox.com",
99
"created": "2020-04-14T00:00:00Z",
1010
"categories": [
1111
"Network Security"
1212
],
13-
"tags": [],
14-
"useCases": [],
13+
"tags": ["Network","Security"],
14+
"useCases": ["Network Security"],
1515
"keywords": [
1616
"Infoblox",
1717
"NIOS",

0 commit comments

Comments
 (0)