elastic / elastic/integrations
[HashiCorp Vault]: Support for KMIP audit logs
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Hashicorp Vault [hashicorp_vault]
### Dataset Name
hashicorp_vault.audit
### Integration Version
1.25.0
### Agent Version
8.15.2
### OS Version and Architecture
Rocky Linux 8.10 (x86_64)
### User Goal
Ingest and parse KMIP audit logs from HashiCorp Vault such as the following:
```
{
"request": {
"client_certificate_serial_number": "123456",
"data": {
"kmip_request": {
"tag": "RequestMessage",
"value": [
{
"tag": "RequestHeader",
"value": [
{
"tag": "ProtocolVersion",
"value": [
{
"tag": "ProtocolVersionMajor",
"type": "Integer",
"value": "0x00000001"
},
{
"tag": "ProtocolVersionMinor",
"type": "Integer",
"value": "0x00000001"
}
]
},
{
"tag": "BatchCount",
"type": "Integer",
"value": "0x00000001"
}
]
},
{
"tag": "BatchItem",
"value": [
{
"tag": "Operation",
"type": "Enumeration",
"value": "0x00000001"
},
{
"tag": "UniqueBatchItemID",
"type": "ByteString",
"value": "123456"
},
{
"tag": "RequestPayload",
"value": []
},
]
}
]
}
},
"namespace": {
"id": "root"
},
"remote_address": "10.10.10.10:10000"
},
"response": {
"data": {
"kmip_response": {
"tag": "ResponseMessage",
"value": [
{
"tag": "ResponseHeader",
"value": [
{
"tag": "ProtocolVersion",
"value": [
{
"tag": "ProtocolVersionMajor",
"type": "Integer",
"value": "0x00000001"
},
{
"tag": "ProtocolVersionMinor",
"type": "Integer",
"value": "0x00000001"
}
]
},
{
"tag": "TimeStamp",
"type": "DateTime",
"value": "2025-01-28T00:00:00Z"
}
{
"tag": "BatchCount",
"type": "Integer",
"value": "0x00000001"
}
]
},
{
"tag": "BatchItem",
"value": [
{
"tag": "Operation",
"type": "Enumeration",
"value": "0x00000001"
},
{
"tag": "UniqueBatchItemID",
"type": "ByteString",
"value": "123456"
},
{
"tag": "ResultStatus",
"type": "Enumeration",
"value": "0x00000000"
}
{
"tag": "ResponsePayload",
"value": [
{
"tag": "ProtocolVersion",
"value": [
{
"tag": "ProtocolVersionMajor",
"type": "Integer",
"value": "0x00000001"
},
{
"tag": "ProtocolVersionMinor",
"type": "Integer",
"value": "0x00000001"
}
]
}
]
},
]
}
]
}
}
},
"time": "2025-01-28T00:00:00.000000000Z",
"type": "kmip-response"
}
```
### Existing Features
The current integration version doesn't support KMIP audit logs, and will throw an error within the ingest pipeline.
### What did you see?
error.message is `field [operation] not present as part of path [hashicorp_vault.audit.request.operation]`
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.