[stormshield] Add outcome, identity and HTTP mappings and extend the metadata allow-list by arenard · Pull Request #20085 · elastic/integrations

arenard · 2026-07-10T13:05:43Z

Proposed commit message

Derive event.outcome on the auth, server and xvpn families from the vendor error return code (0 maps to success, other codes to failure). The official field documentation lists exactly these three families for error; on vpn logs the same key is a severity level and is left untouched. The vendor documentation pairs 0-first numeric examples with Success-first display labels without stating the convention outright, so the mapping follows the strong implication of the field tables.

Map domain to user.domain and usergroup to user.group.name, splitting the comma-separated multi-valued form that SNS 5.x emits. On web logs, map op to http.request.method and result to http.response.status_code; on other families these keys carry protocol-specific codes (FTP, Modbus) and are not promoted. Map the module name in service to process.name on the system, sandboxing and routing families only; on pvm logs the same key names the vulnerable product detected on a scanned host. Set observer.product. All mappings are copies; the vendor keys remain available under stormshield.metadata.

Extend the stormshield.metadata allow-list with the documented vendor keys that previously leaked as undeclared stormshield.* fields: host and IP reputation (srchostrep, dsthostrep, srciprep, dstiprep), alarm packet captures (pktlen, pktdump, pktdumplen), Ethernet protocol (etherproto), SSO agent (agentid), IKE peer name (peername), and the industrial-protocol plugin fields (unitid/unit_id, cipservicecode, cipclassid, requestmode, responsemode, UI, error_class, error_code, format).

The NAT reading of the pipeline was verified against the official field tables while preparing this change: origdst/origdstport are documented as the destination before translation and map to destination.ip/destination.port; dst is the translated destination and maps to destination.nat.ip when it differs. A connection sample with the documented example values now locks this in the pipeline tests, alongside new samples for the alarm reputation and packet-capture fields, a Modbus plugin line (whose result stays under metadata and does not produce http.*), a server line, a system line, and multi- and single-valued usergroup forms.

Design notes

Field semantics all come from the official "Description of Audit logs" guides (v3, v4 and v5 field tables were cross-checked; the v4/v5 Affected logs lists drive the family guards). The alarm class sub-categorization was deliberately left out: the documentation gives example values without an exhaustive list or definitions.
event.outcome is only set where the log reports a return code, never inferred from message text.
Like the 1.6.0 changes, everything is additive: no stormshield.* field changes location or type, so existing dashboards and saved queries are unaffected.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

elastic-package check, test pipeline, test static and test system pass against stack 9.4.3
New pipeline test samples are synthesized from the field example values published in the official audit-log documentation, with addresses in RFC 1918/5737 ranges
The promotions are guarded by log family wherever the vendor documents family-dependent semantics (result, service, error)

How to test this PR locally

cd packages/stormshield
elastic-package check
elastic-package test pipeline
elastic-package stack up -d
elastic-package test system

Related issues

Relates [stormshield] Follow-up tasks for new integration #10114
Requires [stormshield] Add ECS event categorization and network mappings #20031 (stacked; [stormshield] Fix pipeline descriptions and correct documentation claims #20030 has been merged and the branch is rebased on main)

github-actions · 2026-07-10T13:08:01Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

elastic-vault-github-plugin-prod · 2026-07-10T13:29:41Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

infra-vault-gh-plugin-prod · 2026-07-10T20:00:46Z

Pinging @elastic/integration-experience (Team:Integration-Experience)

taylor-swanson · 2026-07-13T13:46:43Z

#20030 has been merged, could you rebase?

arenard · 2026-07-14T14:14:13Z

Thanks @taylor-swanson. Rebased on main following the #20030 and #20031 merge, #20085 and #20088 draft were re-stacked accordingly.

vera-review-bot · 2026-07-14T15:23:44Z

Review summary

Issues found across the latest commits 7109bf4…f99deb3 (3 commits) — 5 medium

🟡 Changelog links a different PR number (link) (Unresolved)
🟡 Changelog links a different PR number (link) (Unresolved)
🟡 Changelog links a different PR number (link) (Unresolved)
🟡 Changelog links a different PR number (link) (Unresolved)
🟡 Changelog links a different PR number (link) (Unresolved)

Issues found across earlier commits 3ccf9e6…1bff832 (28 commits) — 5 medium

🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Unresolved)

Issues found across earlier commits 4ce4236, 8dc4174 — 7 medium

🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)

Issues found across earlier commits 44bf0a4 — 7 medium, 1 low

🔵 The categorization table lists event.category network for dmrouting/routing, but the pipeline sets network, host (link) (Unresolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)
🟡 Changelog links a different PR number (link) (Resolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

…metadata allow-list Derive `event.outcome` on the auth, server and xvpn families from the vendor `error` return code (`0` maps to success, other codes to failure). The official field documentation lists exactly these three families for `error`; on vpn logs the same key is a severity level and is left untouched. The vendor documentation pairs `0`-first numeric examples with `Success`-first display labels without stating the convention outright, so the mapping follows the strong implication of the field tables. Map `domain` to `user.domain` and `usergroup` to `user.group.name`, splitting the comma-separated multi-valued form that SNS 5.x emits. On web logs, map `op` to `http.request.method` and `result` to `http.response.status_code`; on other families these keys carry protocol-specific codes (FTP, Modbus) and are not promoted. Map the module name in `service` to `process.name` on the system, sandboxing and routing families only — on pvm logs the same key names the vulnerable product detected on a scanned host. Set `observer.product`. All mappings are copies; the vendor keys remain available under `stormshield.metadata`. Extend the `stormshield.metadata` allow-list with the documented vendor keys that previously leaked as undeclared `stormshield.*` fields: host and IP reputation (`srchostrep`, `dsthostrep`, `srciprep`, `dstiprep`), alarm packet captures (`pktlen`, `pktdump`, `pktdumplen`), Ethernet protocol (`etherproto`), SSO agent (`agentid`), IKE peer name (`peername`), and the industrial-protocol plugin fields (`unitid`/`unit_id`, `cipservicecode`, `cipclassid`, `requestmode`, `responsemode`, `UI`, `error_class`, `error_code`, `format`). The NAT reading of the pipeline was verified against the official field tables while preparing this change: `origdst`/`origdstport` are documented as the destination before translation and map to `destination.ip`/`destination.port`; `dst` is the translated destination and maps to `destination.nat.ip` when it differs. A connection sample with the documented example values now locks this in the pipeline tests, alongside new samples for the alarm reputation and packet-capture fields, a Modbus plugin line (whose `result` stays under metadata and does not produce `http.*`), a server line, a system line, and multi- and single-valued `usergroup` forms.

elastic-vault-github-plugin-prod · 2026-07-20T08:08:29Z

✅ All changelog entries have the correct PR link.

infra-vault-gh-plugin-prod · 2026-07-20T08:26:10Z

💚 Build Succeeded

Buildkite Build
Commit: cb25778

History

💔 Build #46165 failed 4ed0f60
💔 Build #46162 failed 7f67a83
💔 Build #46025 failed f99deb3
💔 Build #46019 failed 1bff832
💔 Build #45897 failed 8dc4174

vera-review-bot · 2026-07-20T08:28:53Z

⚠️ @arenard I couldn't complete the review for commits 2807630…cb25778 (21 commits) after several attempts. A maintainer can re-run it with @vera-review-bot review.

taylor-swanson

A few minor comments, otherwise it's looking good to me.

taylor-swanson · 2026-07-20T13:01:52Z

+      ignore_empty_value: true
+      if: ctx.stormshield?.domain != null


These two lines do the same thing (the if statement and ignore_empty_value), so only one of them is needed.

I don't have a strong preference on which one to keep. ignore_empty_value shows the intent better than an if statement, but the if statement tends to be more performant.

taylor-swanson · 2026-07-20T13:02:07Z

+      ignore_empty_value: true
+      if: ctx.stormshield?.usergroup != null


These two lines do the same thing, so only one of them is needed.

taylor-swanson · 2026-07-20T13:03:34Z

+      ignore_empty_value: true
+      if: ctx.stormshield?.service != null && ['system', 'sandboxing', 'routing'].contains(ctx.stormshield.logtype)


In this case, we can get rid of ignore_empty_value: true, since the if statement already does this (and does an additional check).

Suggested change

ignore_empty_value: true

if: ctx.stormshield?.service != null && ['system', 'sandboxing', 'routing'].contains(ctx.stormshield.logtype)

if: ctx.stormshield?.service != null && ['system', 'sandboxing', 'routing'].contains(ctx.stormshield.logtype)

botelastic · 2026-08-19T13:59:50Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

vera-review-bot · 2026-08-19T15:33:48Z

@arenard - This PR has merge conflicts with the base branch. Please resolve them.

botelastic · 2026-09-18T16:15:55Z

Hi! This PR has been stale for a while and we're going to close it as part of our cleanup procedure. We appreciate your contribution and would like to apologize if we have not been able to review it, due to the current heavy load of the team. Feel free to re-open this PR if you think it should stay open and is worth rebasing. Thank you for your contribution!

arenard force-pushed the stormshield-sns-enrichment branch from d7aa3c0 to 44bf0a4 Compare July 10, 2026 13:06

andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:stormshield StormShield SNS dashboard Relates to a Kibana dashboard bug, enhancement, or modification. labels Jul 10, 2026

arenard marked this pull request as ready for review July 10, 2026 16:29

arenard requested a review from a team as a code owner July 10, 2026 16:29

This was referenced Jul 10, 2026

[stormshield] Add thematic dashboards and rework the Overview #20088

Closed

[stormshield] Add ECS event categorization and network mappings #20031

Merged

andrewkroh added the Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] label Jul 10, 2026

vera-review-bot Bot reviewed Jul 10, 2026

View reviewed changes

arenard force-pushed the stormshield-sns-enrichment branch from 44bf0a4 to 8dc4174 Compare July 10, 2026 21:17

vera-review-bot Bot reviewed Jul 10, 2026

View reviewed changes

arenard force-pushed the stormshield-sns-enrichment branch from 8dc4174 to 1bff832 Compare July 14, 2026 14:13

arenard force-pushed the stormshield-sns-enrichment branch from 1bff832 to f99deb3 Compare July 14, 2026 14:30

vera-review-bot Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread packages/stormshield/changelog.yml Resolved

Comment thread packages/stormshield/changelog.yml Resolved

Comment thread packages/stormshield/changelog.yml Resolved

Comment thread packages/stormshield/changelog.yml Resolved

Comment thread packages/stormshield/changelog.yml Resolved

vera-review-bot Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread packages/stormshield/changelog.yml Resolved

Comment thread packages/stormshield/changelog.yml Resolved

Comment thread packages/stormshield/changelog.yml Resolved

Comment thread packages/stormshield/changelog.yml Resolved

Comment thread packages/stormshield/changelog.yml Resolved

arenard force-pushed the stormshield-sns-enrichment branch 2 times, most recently from 7f67a83 to 4ed0f60 Compare July 17, 2026 15:38

arenard force-pushed the stormshield-sns-enrichment branch from 78bfed9 to cb25778 Compare July 20, 2026 08:03

arenard mentioned this pull request Jul 20, 2026

[stormshield] Type the detection-relevant vendor fields #20227

Closed

7 tasks done

andrewkroh removed the dashboard Relates to a Kibana dashboard bug, enhancement, or modification. label Jul 20, 2026

taylor-swanson reviewed Jul 20, 2026

View reviewed changes

botelastic Bot added the Stalled label Aug 19, 2026

botelastic Bot closed this Sep 18, 2026

		ignore_empty_value: true
		if: ctx.stormshield?.usergroup != null

		ignore_empty_value: true
		if: ctx.stormshield?.service != null && ['system', 'sandboxing', 'routing'].contains(ctx.stormshield.logtype)

Conversation

arenard commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Design notes

Checklist

Author's Checklist

How to test this PR locally

Related issues

Uh oh!

github-actions Bot commented Jul 10, 2026

✅ Elastic Docs Style Checker (Vale)

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

🚀 Benchmarks report

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

taylor-swanson commented Jul 13, 2026

Uh oh!

arenard commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vera-review-bot Bot commented Jul 14, 2026

Review summary

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 20, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 20, 2026

💚 Build Succeeded

History

Uh oh!

vera-review-bot Bot commented Jul 20, 2026

Uh oh!

taylor-swanson left a comment

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

botelastic Bot commented Aug 19, 2026

Uh oh!

vera-review-bot Bot commented Aug 19, 2026

Uh oh!

botelastic Bot commented Sep 18, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

arenard commented Jul 10, 2026 •

edited

Loading

arenard commented Jul 14, 2026 •

edited

Loading