Skip to content

Commit c59a781

Browse files
authored
akamai: handle empty value placeholder (#15893)
Apparently Akamai use "{p}" to indicate an absent value for this field, so remove it if it is present before handling headers. The test sample was provided by the issue reporter and modified to match test IP constraints.
1 parent 33de257 commit c59a781

File tree

5 files changed

+174
-1
lines changed

5 files changed

+174
-1
lines changed

packages/akamai/changelog.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.28.2"
3+
changes:
4+
- description: Remove empty HTTP message headers placeholder.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15893
27
- version: "2.28.1"
38
changes:
49
- description: Fixed time duration handling in request parameters to conform to API guidelines.
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"attackData":{"appliedAction":"tarpit","clientIP":"198.51.100.1","configId":"67217","policyId":"PNWD_110088","ruleActions":"bW9uaXRvcg%3d%3d%3bbW9uaXRvcg%3d%3d%3bbW9uaXRvcg%3d%3d%3bbW9uaXRvcg%3d%3d%3bbW9uaXRvcg%3d%3d%3bdGFycGl0","ruleData":"%3b%3b%3b%3b%3bQm90X0E5RDg0MDJFQ0NGQjY3N0NCMjBEMDlBRUNDODk5MkFE","ruleMessages":"TWlzc2luZyBDb29raWUgSGVhZGVy%3bTm9uLVBlcnNpc3RlbnQgSFRUUCBDb25uZWN0aW9u%3bQ2hyb21lIFNpZ25hdHVyZSBBbm9tYWx5%3bU2VjLUZldGNoLUhlYWRlciBNaXNzaW5n%3bTG93IEhlYWRlciBDb3VudA%3d%3d%3bVW5rbm93biBCb3RzIChCcm93c2VyIEltcGVyc29uYXRvcik%3d","ruleSelectors":"%3b%3b%3b%3b%3b","ruleTags":"QUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d","ruleVersions":"MQ%3d%3d%3bMQ%3d%3d%3bMQ%3d%3d%3bMQ%3d%3d%3bMQ%3d%3d%3bMQ%3d%3d","rules":"MzkwNDAwNg%3d%3d%3bMzkwNDAwNw%3d%3d%3bMzkwNDAyMA%3d%3d%3bMzkwNDA1Mg%3d%3d%3bMzkwNDA1Mw%3d%3d%3bQk9ULUJST1dTRVItSU1QRVJTT05BVE9S"},"format":"json","geo":{"asn":"28573","city":"SOROCABA","continent":"SA","country":"BR","regionCode":"SP"},"httpMessage":{"bytes":"0","host":"vinrcl.safercar.gov","method":"GET","path":"/vin/","port":"443","protocol":"HTTP/1.1","query":"vin=1G1FD3DSXP0118247","requestHeaders":"Host%3a%20vinrcl.safercar.gov%0d%0aUser-Agent%3a%20Mozilla%2f5.0%20(Windows%20NT%2010.0%3b%20Win64%3b%20x64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f112.0.0.0%20Safari%2f537.36%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml,application%2fxml%3bq%3d0.9,image%2favif,image%2fwebp,image%2fapng,%2f%3bq%3d0.8,application%2fsigned-exchange%3bv%3db3%3bq%3d0.7%0d%0aAccept-Language%3a%20zh-CN,zh%3bq%3d0.9,en%3bq%3d0.8%0d%0aCache-Control%3a%20no-cache%0d%0aConnection%3a%20close%0d%0aAccept-Encoding%3a%20gzip%0d%0a","requestId":"f3fe4c34","responseHeaders":"{p}","start":"1762365006","status":"200","tls":"tls1.3"},"identity":{"ja4":"t13d131000_f57a46bbacb6_e7c285222651","tlsFingerprintV2":"c6a4ce37a8dc4153","tlsFingerprintV3":"3~de293936a8dc4153"},"type":"akamai_siem","version":"1.0"}
Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2025-11-05T17:50:06.000Z",
5+
"akamai": {
6+
"siem": {
7+
"config_id": "67217",
8+
"policy_id": "PNWD_110088",
9+
"request": {
10+
"headers": {
11+
"Accept": "text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7",
12+
"Accept-Encoding": "gzip",
13+
"Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8",
14+
"Cache-Control": "no-cache",
15+
"Connection": "close",
16+
"Host": "vinrcl.safercar.gov",
17+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"
18+
}
19+
},
20+
"rule_actions": [
21+
"monitor",
22+
"tarpit"
23+
],
24+
"rule_tags": [
25+
"akamai/bot/bid"
26+
],
27+
"rules": [
28+
{
29+
"ruleActions": "monitor",
30+
"ruleMessages": "Missing Cookie Header",
31+
"ruleTags": "AKAMAI/BOT/BID",
32+
"ruleVersions": "1",
33+
"rules": "3904006"
34+
},
35+
{
36+
"ruleActions": "monitor",
37+
"ruleMessages": "Non-Persistent HTTP Connection",
38+
"ruleTags": "AKAMAI/BOT/BID",
39+
"ruleVersions": "1",
40+
"rules": "3904007"
41+
},
42+
{
43+
"ruleActions": "monitor",
44+
"ruleMessages": "Chrome Signature Anomaly",
45+
"ruleTags": "AKAMAI/BOT/BID",
46+
"ruleVersions": "1",
47+
"rules": "3904020"
48+
},
49+
{
50+
"ruleActions": "monitor",
51+
"ruleMessages": "Sec-Fetch-Header Missing",
52+
"ruleTags": "AKAMAI/BOT/BID",
53+
"ruleVersions": "1",
54+
"rules": "3904052"
55+
},
56+
{
57+
"ruleActions": "monitor",
58+
"ruleMessages": "Low Header Count",
59+
"ruleTags": "AKAMAI/BOT/BID",
60+
"ruleVersions": "1",
61+
"rules": "3904053"
62+
},
63+
{
64+
"ruleActions": "tarpit",
65+
"ruleData": "Bot_A9D8402ECCFB677CB20D09AECC8992AD",
66+
"ruleMessages": "Unknown Bots (Browser Impersonator)",
67+
"ruleTags": "AKAMAI/BOT/BID",
68+
"ruleVersions": "1",
69+
"rules": "BOT-BROWSER-IMPERSONATOR"
70+
}
71+
]
72+
}
73+
},
74+
"client": {
75+
"address": "198.51.100.1",
76+
"as": {
77+
"number": 64501,
78+
"organization": {
79+
"name": "Documentation ASN"
80+
}
81+
},
82+
"geo": {
83+
"city_name": "Amsterdam",
84+
"continent_name": "Europe",
85+
"country_iso_code": "NL",
86+
"country_name": "Netherlands",
87+
"location": {
88+
"lat": 52.37404,
89+
"lon": 4.88969
90+
},
91+
"region_iso_code": "NL-NH",
92+
"region_name": "North Holland"
93+
},
94+
"ip": "198.51.100.1"
95+
},
96+
"ecs": {
97+
"version": "8.11.0"
98+
},
99+
"event": {
100+
"category": [
101+
"network"
102+
],
103+
"id": "f3fe4c34",
104+
"kind": "event",
105+
"original": "{\"attackData\":{\"appliedAction\":\"tarpit\",\"clientIP\":\"198.51.100.1\",\"configId\":\"67217\",\"policyId\":\"PNWD_110088\",\"ruleActions\":\"bW9uaXRvcg%3d%3d%3bbW9uaXRvcg%3d%3d%3bbW9uaXRvcg%3d%3d%3bbW9uaXRvcg%3d%3d%3bbW9uaXRvcg%3d%3d%3bdGFycGl0\",\"ruleData\":\"%3b%3b%3b%3b%3bQm90X0E5RDg0MDJFQ0NGQjY3N0NCMjBEMDlBRUNDODk5MkFE\",\"ruleMessages\":\"TWlzc2luZyBDb29raWUgSGVhZGVy%3bTm9uLVBlcnNpc3RlbnQgSFRUUCBDb25uZWN0aW9u%3bQ2hyb21lIFNpZ25hdHVyZSBBbm9tYWx5%3bU2VjLUZldGNoLUhlYWRlciBNaXNzaW5n%3bTG93IEhlYWRlciBDb3VudA%3d%3d%3bVW5rbm93biBCb3RzIChCcm93c2VyIEltcGVyc29uYXRvcik%3d\",\"ruleSelectors\":\"%3b%3b%3b%3b%3b\",\"ruleTags\":\"QUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d%3bQUtBTUFJL0JPVC9CSUQ%3d\",\"ruleVersions\":\"MQ%3d%3d%3bMQ%3d%3d%3bMQ%3d%3d%3bMQ%3d%3d%3bMQ%3d%3d%3bMQ%3d%3d\",\"rules\":\"MzkwNDAwNg%3d%3d%3bMzkwNDAwNw%3d%3d%3bMzkwNDAyMA%3d%3d%3bMzkwNDA1Mg%3d%3d%3bMzkwNDA1Mw%3d%3d%3bQk9ULUJST1dTRVItSU1QRVJTT05BVE9S\"},\"format\":\"json\",\"geo\":{\"asn\":\"28573\",\"city\":\"SOROCABA\",\"continent\":\"SA\",\"country\":\"BR\",\"regionCode\":\"SP\"},\"httpMessage\":{\"bytes\":\"0\",\"host\":\"vinrcl.safercar.gov\",\"method\":\"GET\",\"path\":\"/vin/\",\"port\":\"443\",\"protocol\":\"HTTP/1.1\",\"query\":\"vin=1G1FD3DSXP0118247\",\"requestHeaders\":\"Host%3a%20vinrcl.safercar.gov%0d%0aUser-Agent%3a%20Mozilla%2f5.0%20(Windows%20NT%2010.0%3b%20Win64%3b%20x64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f112.0.0.0%20Safari%2f537.36%0d%0aAccept%3a%20text%2fhtml,application%2fxhtml+xml,application%2fxml%3bq%3d0.9,image%2favif,image%2fwebp,image%2fapng,%2f%3bq%3d0.8,application%2fsigned-exchange%3bv%3db3%3bq%3d0.7%0d%0aAccept-Language%3a%20zh-CN,zh%3bq%3d0.9,en%3bq%3d0.8%0d%0aCache-Control%3a%20no-cache%0d%0aConnection%3a%20close%0d%0aAccept-Encoding%3a%20gzip%0d%0a\",\"requestId\":\"f3fe4c34\",\"responseHeaders\":\"{p}\",\"start\":\"1762365006\",\"status\":\"200\",\"tls\":\"tls1.3\"},\"identity\":{\"ja4\":\"t13d131000_f57a46bbacb6_e7c285222651\",\"tlsFingerprintV2\":\"c6a4ce37a8dc4153\",\"tlsFingerprintV3\":\"3~de293936a8dc4153\"},\"type\":\"akamai_siem\",\"version\":\"1.0\"}",
106+
"start": "2025-11-05T17:50:06.000Z"
107+
},
108+
"http": {
109+
"request": {
110+
"id": "f3fe4c34",
111+
"method": "GET"
112+
},
113+
"response": {
114+
"bytes": 0,
115+
"status_code": 200
116+
},
117+
"version": "1.1"
118+
},
119+
"network": {
120+
"protocol": "http",
121+
"transport": "tcp"
122+
},
123+
"observer": {
124+
"type": "proxy",
125+
"vendor": "akamai"
126+
},
127+
"related": {
128+
"ip": [
129+
"198.51.100.1"
130+
]
131+
},
132+
"source": {
133+
"address": "198.51.100.1",
134+
"as": {
135+
"number": 64501,
136+
"organization": {
137+
"name": "Documentation ASN"
138+
}
139+
},
140+
"geo": {
141+
"city_name": "Amsterdam",
142+
"continent_name": "Europe",
143+
"country_iso_code": "NL",
144+
"country_name": "Netherlands",
145+
"location": {
146+
"lat": 52.37404,
147+
"lon": 4.88969
148+
},
149+
"region_iso_code": "NL-NH",
150+
"region_name": "North Holland"
151+
},
152+
"ip": "198.51.100.1"
153+
},
154+
"url": {
155+
"domain": "vinrcl.safercar.gov",
156+
"full": "vinrcl.safercar.gov/vin/?vin=1G1FD3DSXP0118247",
157+
"path": "/vin/",
158+
"port": 443,
159+
"query": "vin=1G1FD3DSXP0118247"
160+
}
161+
}
162+
]
163+
}

packages/akamai/data_stream/siem/elasticsearch/ingest_pipeline/default.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,10 @@ processors:
114114
tag: urldecode_httpMessage_responseHeaders
115115
field: json.httpMessage.responseHeaders
116116
ignore_missing: true
117+
- remove:
118+
tag: remove_http_message_response_headers_empty_placeholder
119+
field: json.httpMessage.responseHeaders
120+
if: ctx.json.httpMessage?.responseHeaders == "{p}"
117121
- kv:
118122
if: ctx.json.httpMessage?.responseHeaders != ""
119123
tag: kv_httpMessage_responseHeaders

packages/akamai/manifest.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: akamai
22
title: Akamai
3-
version: "2.28.1"
3+
version: "2.28.2"
44
description: Collect logs from Akamai with Elastic Agent.
55
type: integration
66
format_version: "3.0.2"

0 commit comments

Comments
 (0)