[lastpass] Initial Release for the LastPass by vinit-chauhan · Pull Request #4254 · elastic/integrations

vinit-chauhan · 2022-09-21T16:33:51Z

What does this PR do?

Generated the skeleton of the LastPass integration package.
Added data streams.
Added data collection logic for all the data streams.
Added the ingest pipeline for all the data streams.
Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files.
Added dashboards and visualizations.
Added test for pipeline for all the data streams.
Added system test cases for all the data streams.

NOTE: Following are the events which we have covered in the Event Report data stream.

Events
Login Verification Email Sent
Log in
Login to Admin Console
SAML Login
Open Secure Note
Make Admin
Enterprise API Secret regenerated
Update Folder Permissions
Master Password Changed
Master Password Reset by Super Admin
Require Password Change
Employee Account Created
Created LastPass Account
Created Shared Folder
Add Secure Note
Site Added
Add to Shared Folder
Add Policy
Deleted Sites
Delete Policy
Deleted Shared Folder
Employee Account Deleted
Remove Admin
Create Group
Adding User to Group
Get Shared Folder Data
Get User Data
Employee Invited
Reporting
Failed Login Attempt
Edit Secure Note
Renamed Shared Folder
Move to Shared Folder
Move from Shared Folder
Limit Shared Folder
Removed From Shared Folder
Delete Shared Sites
Multifactor Enabled

Integration release checklist

This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.

All changes

Change follows the contributing guidelines
Supported versions of the monitoring target are documented
Supported operating systems are documented (if applicable)
Integration or System tests exist
Documentation exists
Fields follow ECS and naming conventions
At least a manual test with ES / Kibana / Agent has been performed.
Required Kibana version set to: ^7.17.0 || ^8.0.0

New Package

Screenshot of the "Add Integration" page on Fleet added

Dashboards changes

Dashboards exists
Screenshots added or updated
Datastream filters added to visualizations

Log dataset changes

Pipeline tests exist (if applicable)
Generated output for at least 1 log file exists
Sample event (sample_event.json) exists

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/lastpass directory.
Run the following command to run tests.

elastic-package test

Related issues

Closes LastPass #1157

Screenshots

elasticmachine · 2022-09-21T16:36:57Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

elasticmachine · 2022-09-21T16:41:16Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-09-30T17:00:48.401+0000
Duration: 16 min 43 sec

Test stats 🧪

Test	Results
Failed	0
Passed	20
Skipped	0
Total	20

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

vinit-chauhan · 2022-09-21T16:57:05Z

/test

elasticmachine · 2022-09-22T05:46:04Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2022-09-22T05:46:20Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`3/3`)	💚
Files	100.0% (`3/3`)	💚 2.564
Classes	100.0% (`3/3`)	💚 2.564
Methods	100.0% (`37/37`)	💚 9.946
Lines	93.816% (`622/663`)	👍 2.287
Conditionals	100.0% (`0/0`)	💚

P1llus

Adding a few small comments

P1llus · 2022-09-28T09:27:25Z

+{{/if}}
+{{#if ssl}}
+request.ssl: {{ssl}}
+{{/if}}


Could we add a configurable request.timeout as well?

We are following the default request.timeout the 30s value.

The other httpjson based integration allows this to be customized by users by adding a UI entry and a config entry for it, similar to this:

{{#if http_client_timeout}} request.timeout: {{http_client_timeout}} {{/if}}

Its usually because there are niche usecases that they need to be configured, and if its not possible at all for the end user to override it, then we usually have to update the package to support it. If its missing from any httpjson based integrations then its usually because its older, or it has not been added by mistake.

P1llus · 2022-09-28T09:32:47Z

+        show_user: false
+        default:
+          - forwarded
+          - lastpass_detailed_shared_folder


This should be lastpass-detailed_shared_folder

We were following the format (connector_name-data_stream). However, we got the following #3210 (comment) in one of our connectors, since then we have updated the format.

Correct, the package name and datastream name should be split with a - which is used on all the other older integrations, unfortunately there might be a bit of a confusion around this. Feel free to reference any of the older integrations there, I do not think any of them only use _

P1llus · 2022-09-28T09:33:22Z

+interval: {{interval}}
+{{#if proxy_url}}
+request.proxy_url: {{proxy_url}}
+{{/if}}


Could we add a configurable request.timeout ?

P1llus · 2022-09-28T09:33:50Z

+        show_user: false
+        default:
+          - forwarded
+          - lastpass_event_report


lastpass-event_report

P1llus · 2022-09-28T09:34:04Z

+interval: {{interval}}
+{{#if proxy_url }}
+request.proxy_url: {{proxy_url}}
+{{/if}}


Same request.timeout

P1llus · 2022-09-28T09:34:34Z

+        show_user: false
+        default:
+          - forwarded
+          - lastpass_user


lastpass-user

…ions

* Initial Release for the LastPass * Update changelog file * Add related.user field and switched kql query to filter in visualizations * Add request.timeout parameter & update tag and user guide

vinit-chauhan added 2 commits September 21, 2022 21:36

Initial Release for the LastPass

8200be7

Update changelog file

adda273

vinit-chauhan added enhancement New feature or request Team:Security-External Integrations New Integration Issue or pull request for creating a new integration package. labels Sep 21, 2022

P1llus self-assigned this Sep 28, 2022

P1llus self-requested a review September 28, 2022 08:07

P1llus reviewed Sep 28, 2022

View reviewed changes

vinit-chauhan added 2 commits September 29, 2022 18:56

Add related.user field and switched kql query to filter in visualizat…

de0aed0

…ions

Add request.timeout parameter & update tag and user guide

a471eee

P1llus approved these changes Oct 4, 2022

View reviewed changes

P1llus merged commit e95753d into elastic:main Oct 4, 2022

a03nikki mentioned this pull request Nov 29, 2022

Create new module or integration for LastPass logs elastic/beats#25531

Closed

vinit-chauhan deleted the package_lastpass branch April 1, 2026 23:57

Uh oh!

Conversation

vinit-chauhan commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Integration release checklist

All changes

New Package

Dashboards changes

Log dataset changes

How to test this PR locally

Related issues

Screenshots

Uh oh!

elasticmachine commented Sep 21, 2022

Uh oh!

elasticmachine commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

Uh oh!

vinit-chauhan commented Sep 21, 2022

Uh oh!

elasticmachine commented Sep 22, 2022

🚀 Benchmarks report

Uh oh!

elasticmachine commented Sep 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌐 Coverage report

Uh oh!

P1llus left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vinit-chauhan commented Sep 21, 2022 •

edited

Loading

elasticmachine commented Sep 21, 2022 •

edited

Loading

elasticmachine commented Sep 22, 2022 •

edited

Loading