Repository navigation
fix(demo): add the cyber demo pack's sources, events and console - #384
Merged
Merged
Conversation
A pack source matched on data_stream.dataset is a Beats source. The intake no longer needs to detect Beats sources. Their events replay through the receiver's HTTP ingest. Loading rejects a Beats source if its first event carries another dataset or is not a Beats envelope. It also rejects a Beats source if its transform engine is not elastic. Packs without events/generate.py for replay are rejected. The pack overlay adds a demo-beats container. It loops the pack's events/generate.py replay against http://dfe-receiver:8080/ingest once the sources exist and the receiver is healthy. Each Beats source gets its own dfe-transform-elastic instance in the published file. The engine's hosted-instance setting lists each instance beside the intake and vendors. No override is needed to run a Beats transform instance. The demo's own file is byte-identical to the one main writes.
resources/demo-cyber/ shows incoming traffic, sign-in origins and blocklisted sources. - Six sources: demo-syslog, cisco-asa and fortinet supply firewall events. okta, crowdstrike and o365 use the Beats intake. data_stream.dataset routes them to their filebeat variants. - events/generate.py writes 6,000 lines per source. Firewall lines reuse the demo's generator with 16 hosts on eight Spamhaus DROP networks among the outside addresses. Beats lines vary records from the Panther (Apache-2.0) and BOTS v3 (CC0) samples named in events/PROVENANCE.md. Replay mode posts them to the receiver's /ingest with every record's time set to now. - Five dashboards: denied connections by firewall and rule, DROP-listed traffic, sign-ins by outcome and country, EDR detections by severity and host, and Microsoft 365 admin actions by actor. - Seven searches: a live tail per source, denied DROP-listed traffic, and failed sign-ins in the last hour. - A rule and hunt for failed Okta sign-ins from a DROP-listed network. - .gitignore keeps pack event logs. check-python lints the pack.
catinspace-au
force-pushed
the
feat/demo-pack-cyber
branch
from
November 13, 2026 22:06
6ebbea2 to
0507445
Compare
The demo-sources one-shot now creates each rule under the pack's rules/ and then each hunt under hunts/, after the sources are deployed. Anything the engine already holds is left alone. The manifest check refuses a pack whose demo.json hunts list differs from hunts/. It also refuses a hunt that runs a rule the pack does not carry.
A rule or hunt the engine rejects no longer fails the demo-sources one-shot. Requests retry for up to 60 seconds after a 5xx or no answer. A 4xx or a final failure prints a WARNING with the engine's answer, and the run goes on. A hunt whose rule did not install is skipped. - froth.ly, the frothly tenant names, hobbiton.co, panther.com, springfield.gov, email.com, emaildomain.com and acme.io become example.com. - live.com, naver.com and the Okta ISP domains become example.net, and info.org becomes example.org. - Okta's securityContext uses documentation ASNs. - Each o365 record names one person: Actor and UserKey follow UserId. CrowdStrike audit actor_user follows UserId too. PROVENANCE.md drops the MIT line, since no MIT sample is used. The Apache-2.0 and CC0 texts sit in events/LICENSES/, which the pack loader skips. check-python lints resources/demo-*/.
The okta, o365 and crowdstrike samples carried the upstream personas. The generator maps each person to the same demo staff name or mailbox across sources before the domain map runs. - BOTS v3 users ghoppy, bgist, bstoll, fyodor, klagerfield, jacobsmythe, mkraeusen, pcerf, jwortoski, btun and abungstein become demo staff. - The external hyunki1984 and the UBA Bank sender become supplier and payments. - Panther's homer, eric.montgomery, vanessajohns, john.doe and their display names become staff. - Alice Green becomes Alice. - CrowdStrike audit action_target_name follows target_name. The firewall logs are byte-identical. PROVENANCE.md identifies the people as demo staff.
The site's install block links each pack to its use_case path. hyperi.io serves the cyber use case at /solutions/security-monitoring/.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
resources/demo-cyber/ shows incoming traffic, sign-in origins and blocklisted sources.