cisco_duo: Parse the adaptive_trust_assessments and rbfs_triggered_attacks fields for authentication logs

Add support for the few missing fields, as well as the `adaptive_trust_assessments` and `rbfs_triggered_attacks`
fields in the `auth` data stream. A sample test case has been collected from the Cisco Duo documentation.

Author: brijesh-elastic

packages/cisco_duo/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.8.0"
+  changes:
+    - description: Parse the `adaptive_trust_assessments` and `rbfs_triggered_attacks` fields for the `auth` data stream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/16490
 - version: "2.7.0"
   changes:
     - description: Enable Agentless deployment.

packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-auth.log

@@ -15,3 +15,5 @@
 {"access_device":{"browser":null,"browser_version":null,"epkey":null,"flash_version":null,"hostname":"pilot","ip":"89.160.20.156","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":null,"location":{"city":null,"country":null,"state":null},"os":null,"os_version":null,"security_agents":[]},"alias":"","application":{"key":"DIY231J8BR23QK4UKBY8","name":"OS Application 1"},"auth_device":{"ip":"81.2.69.144","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"+91 12345 12345"},"email":"","event_type":"authentication","factor":"duo_push","isotimestamp":"2021-07-23T07:19:34.702203+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1627024774,"trusted_endpoint_status":"unknown","txid":"e22120cd-7388-424f-aa0a-b60cad42d8f5","user":{"groups":[],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway"}}
 {"access_device":{"browser":null,"browser_version":null,"epkey":null,"flash_version":null,"hostname":"pilot","ip":"89.160.20.156","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":null,"location":{"city":null,"country":null,"state":null},"os":null,"os_version":null,"security_agents":"unknown"},"alias":"","application":{"key":"DIY231J8BR23QK4UKBY8","name":"OS Application 1"},"auth_device":{"ip":"81.2.69.144","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"+91 12345 12345"},"email":"","event_type":"authentication","factor":"duo_push","isotimestamp":"2021-07-23T07:19:34.702203+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1627024774,"trusted_endpoint_status":"unknown","txid":"e22120cd-7388-424f-aa0a-b60cad42d8f3","user":{"groups":[],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway"}}
 {"access_device":{"browser":"Chrome","browser_version":"92.0.4515.107","epkey":null,"flash_version":null,"hostname":"al","ip":"81.2.69.144","is_encryption_enabled":true,"is_firewall_enabled":true,"is_password_set":true,"java_version":null,"location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Windows","os_version":"10.0.1893.15","security_agents":[{"security_agent":"cisco-amp","version":"1"}]},"alias":"unknown","application":{"key":"DIY231J8BR23QK4UKBY8","name":"portal"},"auth_device":{"ip":null,"location":{"city":null,"country":null,"state":null},"name":null},"email":null,"event_type":"enrollment","factor":"not_available","isotimestamp":"2021-07-23T07:19:34.702203+00:00","ood_software":null,"reason":null,"result":"success","timestamp":1627024774,"trusted_endpoint_status":"unknown","txid":"e22120cd-7388-424f-aa0a-b60cad42d8f3","user":{"groups":[],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway"}}
+{"access_device":{"browser":"Chrome","browser_version":"67.0.3396.99","epkey":"EP18JX1A10AB102M2T2X","flash_version":"uninstalled","hostname":null,"ip":"175.16.199.1","is_encryption_enabled":true,"is_firewall_enabled":true,"is_password_set":true,"java_version":"uninstalled","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Mac OS X","os_version":"10.14.1","security_agents":[]},"adaptive_trust_assessments":{"more_secure_auth":{"detected_attack_detectors":["USER_MARKED_FRAUD"],"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":true,"reason":"Low level of trust; detection of one or more known attack patterns","trust_level":"LOW"},"remember_me":{"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"reason":"Known Access IP","trust_level":"NORMAL"}},"alias":"","application":{"destination_name":"Microsoft 365","key":"DIY231J8BR23QK4UKBY8","name":"Acme Corp IdP"},"auth_device":{"ip":"1.128.0.1","key":"DP5BJ05HI4WRBVI4Q7JF","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"My iPhone X (734-555-2342)"},"email":"[email protected]","event_type":"authentication","factor":"duo_push","isotimestamp":"2020-02-13T18:56:20.351346+00:00","ood_software":null,"passport_assessment":{"is_supported":false,"reason":"absent_health_report"},"reason":"user_approved","result":"success","timestamp":1581620180,"trusted_endpoint_status":"not trusted","trusted_session_info":{"trusted_session_uuid":"e31c4bb7-e991-469c-b339-f6117cb8f562"},"txid":"340a23e3-23f3-23c1-87dc-1491a23dfdbb","user":{"groups":["Duo Users","CorpHQ Users"],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"[email protected]"}}
+{"access_device":{"browser":"Chrome","browser_version":"128.0.6613.120","epkey":"EP2ULFE874LMXBYJZE4D","flash_version":"uninstalled","hostname":null,"ip":"1.128.0.1","is_encryption_enabled":true,"is_firewall_enabled":true,"is_password_set":true,"java_version":"uninstalled","location":{"city":"Detroit","country":"United States","state":"Michigan"},"os":"Mac OS X","os_version":"14.6.1","security_agents":[{"security_agent":"cisco-amp","version":"1.24.0.967"}]},"adaptive_trust_assessments":{"more_secure_auth":{"detected_attack_detectors":["NOVEL_ASN"],"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"preview_mode_enabled":true,"reason":"Low level of trust; detection of one or more known attack patterns","trust_level":"LOW"},"remember_me":{"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"reason":"Novel Access IP","trust_level":"LOW"}},"alias":"","application":{"key":"DI0P00LD4DX50O2VCAVK","name":"Acme Corp","destination_name":"Acme Intranet"},"auth_device":{"ip":"175.16.199.1","key":"DP5IWE1PCVP00LD4D64A","location":{"city":"Detroit","country":"United States","state":"Michigan"},"name":"Norben's Phone"},"email":"[email protected]","event_type":"authentication","factor":"duo_push","isotimestamp":"2024-09-10T18:57:44.444611+00:00","ood_software":null,"rbfs_triggered_attacks":[{"country_code_access":null,"country_code_auth":null,"detected_occurrences":1,"detector":"NOVEL_ASN","shadow_mode":false,"suppressed":null,"threshold_occurrences":1,"threshold_time_frame":null,"unrealistic_travel_velocity":null},{"country_code_access":"US","country_code_auth":"IN","detected_occurrences":1,"detector":"NOVEL_ASN","shadow_mode":false,"suppressed":"KNOWN_IP","threshold_occurrences":1,"threshold_time_frame":86400,"unrealistic_travel_velocity":3360}],"reason":"user_approved","result":"success","timestamp":1725994664,"trusted_endpoint_status":"unknown","txid":"08bfd78a-7b70-4818-af15-104744ab3609","user":{"groups":[],"key":"DU53P00LD4D4C075WQGK","name":"narroway"}}