elastic / elastic/integrations

[HashiCorp Vault]: Support for KMIP audit logs

Open
#12,498 4 comments 0 reactions 0 assignees View on GitHub
Integration:hashicorp_vault needs:triage Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Hashicorp Vault [hashicorp_vault]

### Dataset Name

hashicorp_vault.audit

### Integration Version

1.25.0

### Agent Version

8.15.2

### OS Version and Architecture

Rocky Linux 8.10 (x86_64)

### User Goal

Ingest and parse KMIP audit logs from HashiCorp Vault such as the following:

```
{
"request": {
"client_certificate_serial_number": "123456",
"data": {
"kmip_request": {
"tag": "RequestMessage",
"value": [
{
"tag": "RequestHeader",
"value": [
{
"tag": "ProtocolVersion",
"value": [
{
"tag": "ProtocolVersionMajor",
"type": "Integer",
"value": "0x00000001"
},
{
"tag": "ProtocolVersionMinor",
"type": "Integer",
"value": "0x00000001"
}
]
},
{
"tag": "BatchCount",
"type": "Integer",
"value": "0x00000001"
}
]
},
{
"tag": "BatchItem",
"value": [
{
"tag": "Operation",
"type": "Enumeration",
"value": "0x00000001"
},
{
"tag": "UniqueBatchItemID",
"type": "ByteString",
"value": "123456"
},
{
"tag": "RequestPayload",
"value": []
},
]
}
]
}
},
"namespace": {
"id": "root"
},
"remote_address": "10.10.10.10:10000"
},
"response": {
"data": {
"kmip_response": {
"tag": "ResponseMessage",
"value": [
{
"tag": "ResponseHeader",
"value": [
{
"tag": "ProtocolVersion",
"value": [
{
"tag": "ProtocolVersionMajor",
"type": "Integer",
"value": "0x00000001"
},
{
"tag": "ProtocolVersionMinor",
"type": "Integer",
"value": "0x00000001"
}
]
},
{
"tag": "TimeStamp",
"type": "DateTime",
"value": "2025-01-28T00:00:00Z"
}
{
"tag": "BatchCount",
"type": "Integer",
"value": "0x00000001"
}
]
},
{
"tag": "BatchItem",
"value": [
{
"tag": "Operation",
"type": "Enumeration",
"value": "0x00000001"
},
{
"tag": "UniqueBatchItemID",
"type": "ByteString",
"value": "123456"
},
{
"tag": "ResultStatus",
"type": "Enumeration",
"value": "0x00000000"
}
{
"tag": "ResponsePayload",
"value": [
{
"tag": "ProtocolVersion",
"value": [
{
"tag": "ProtocolVersionMajor",
"type": "Integer",
"value": "0x00000001"
},
{
"tag": "ProtocolVersionMinor",
"type": "Integer",
"value": "0x00000001"
}
]
}
]
},
]
}
]
}
}
},
"time": "2025-01-28T00:00:00.000000000Z",
"type": "kmip-response"
}
```

### Existing Features

The current integration version doesn't support KMIP audit logs, and will throw an error within the ingest pipeline.

### What did you see?

error.message is `field [operation] not present as part of path [hashicorp_vault.audit.request.operation]`

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.