Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AtlassianJira Audit logs #156

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

AtlassianJira Audit logs #156

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
500297e
Create ReadMe.md
jakob-source Jan 18, 2023
612d8ca
Create AtlassianJira-Workflow.xml
jakob-source Jan 18, 2023
a3ccd9c
Create AtlassianJira-Workflow-Parameter-Values.xml
jakob-source Jan 18, 2023
c1417c1
Update AtlassianJira-Workflow.xml
jakob-source Jan 18, 2023
32761d3
Update AtlassianJira-Workflow.xml
jakob-source Jan 18, 2023
e72d30c
Update AtlassianJira-Workflow.xml
jakob-source Jan 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions Community Developed/Atlassian Jira/AtlassianJira-Workflow-Parameter-Values.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="UTF-8" ?>
<WorkflowParameterValues xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/WorkflowParameterValues/V1">
<Value name="host" value="" />
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Readme should include this field along with an example, and should clearly define whether it is just the hostname or the full URL with http://, etc.

I can see from the code it's just the hostname, but providing examples in the readme help usability. Consider including how to specify an alternate port as well if not 443.

<Value name="user_id" value="" />
<Value name="token" value="" />
</WorkflowParameterValues>
38 changes: 38 additions & 0 deletions Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="UTF-8" ?>
<Workflow name="AtlassianJira" version="1.0" xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/Workflow/V1">

<Parameters>
<Parameter name="host" label="host" required="true" />
<Parameter name="token" label="token" required="true" />
<Parameter name="user_id" label="user_id" required="true" />
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indentation cleanup.

</Parameters>

<Actions>

<Initialize path="/get_logs/bookmark" value="0" />
<CallEndpoint url="https://${/host}/rest/api/3/auditing/record" method="GET" savePath="/get_logs">
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are no query parameters here, meaning no timestamp bounds have been applied, so this query will match EVERY record available EVERY time the workflow runs as it is written here.

https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-audit-records/#api-rest-api-3-auditing-record-get

I see on line 30 you set the record count as the offset but I don't know if /get_logs/body/total will contain the total number in the query, or just those returned in the one page your query gets.

This will result in a workflow that missed data on the initial result, and then on subsequent runs queries all of time but pages to recent records. This is likely to cause performance issues on the Atlassian side.

Normally a workflow will use a time bound query (from and to) in the Atlassian docs and extract timestamps from each record and persist the last one to be used as the from on subsequent queries.

<SSLConfiguration allowUntrustedServerCertificate="true" />
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For security reasons this probably shouldn't be true by default as setting it true can cause extra work.

If this is true, you will HAVE to copy the certificate from the Jira server to the QRadar host. If this server has a proper certificate issued by a recognized issuer you do not need to set this to true and it should be false for a more secure certificate negotiation.

If using a self-signed certificate, then this must be set to true and copy the remote certificate to local.

You may have found during testing that it was needed based on whatever.

I would make this a variable in the Parameters file, and include in the readme when it should be set to true (if using a self-signed certificate) and set it to false by default.

<BasicAuthentication username="${/user_id}" password="${/token}" />
<QueryParameter name="offset=" value="${/get_logs/bookmark}" />
<QueryParameter name="limit=" value="1000" />
<RequestHeader name="Content-Type" value="application/json" />
</CallEndpoint>

<!-- Handle Errors -->
<If condition="/get_logs/status_code != 200">
<Abort reason="${/get_logs/status_code}" />
</If>

<!-- Post Events -->
<PostEvents path="/get_logs/body/records" source="${/host}"/>

<!-- Update the bookmark -->
<Set path="/get_logs/bookmark" value="${/get_logs/body/total}" />

</Actions>

<Tests>
<DNSResolutionTest host="${/host}" />
</Tests>

</Workflow>
7 changes: 7 additions & 0 deletions Community Developed/Atlassian Jira/ReadMe.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Atlassian Jira
The Jira workflow collects audit logs from audit API.

## Authentication Set-Up
When setting up the workflow for Atlassian Cloud you will need to use the "Jira User Identifier" and "Jira API Token" fields in the Workflow Parameter Values file. These will allow connection to the [Atlassian Cloud REST API](https://developer.atlassian.com/cloud/jira/platform/basic-auth-for-rest-apis/) via [Basic Authentication](https://developer.atlassian.com/cloud/jira/platform/basic-auth-for-rest-apis/).

You need to uncheck Coalescing Events option during log source configuration.