chore(deps): update contributor-assistant/github-action action to v2.6.1 - abandoned

.github/ISSUE_TEMPLATE/bug-escalation-report.md

@@ -7,6 +7,8 @@ assignees: ''
 
 ---
 
+**Note: If your issue is not a bug or a feature request, please raise a support ticket through our support portal (Splunk.com > Support > Support Portal). This will help us resolve your issue more efficiently and provide you with better assistance. For more information on how to work with the Splunk Support, please refer to [this guide](https://splunk.my.site.com/customer/s/article/Working-with-Support-and-the-Support-Portal).**
+
 **Was the issue replicated by support?**
 
 **What is the sc4s version ?**

.github/ISSUE_TEMPLATE/feature-request-e-g--a-new-filter--a-new-processor-etc--.md

@@ -7,6 +7,8 @@ assignees: ''
 
 ---
 
+**Note: If your issue is not a bug or a feature request, please raise a support ticket through our support portal (Splunk.com > Support > Support Portal). This will help us resolve your issue more efficiently and provide you with better assistance. For more information on how to work with the Splunk Support, please refer to [this guide](https://splunk.my.site.com/customer/s/article/Working-with-Support-and-the-Support-Portal).**
+
 **What is the sc4s version?**
 
 **Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?**

.github/workflows/agreements.yaml

@@ -18,7 +18,7 @@ jobs:
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
         # Alpha Release
-        uses: contributor-assistant/github-action@v2.4.0
+        uses: contributor-assistant/github-action@v2.6.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret
@@ -43,7 +43,7 @@ jobs:
       - name: "COC Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the Code of Conduct and I hereby accept the Terms') || github.event_name == 'pull_request_target'
         # Alpha Release
-        uses: contributor-assistant/github-action@v2.4.0
+        uses: contributor-assistant/github-action@v2.6.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret

.github/workflows/ci-lite.yaml

@@ -86,7 +86,7 @@ jobs:
             type=ref,event=tag
       - name: matrix
         id: matrix
-        uses: splunk/addonfactory-test-matrix-action@v1.13.1
+        uses: splunk/addonfactory-test-matrix-action@v2.1.8
 
   security-fossa-scan:
     continue-on-error: true

.github/workflows/ci-main.yaml

@@ -86,7 +86,7 @@ jobs:
             type=ref,event=tag
       - name: matrix
         id: matrix
-        uses: splunk/addonfactory-test-matrix-action@v1.13.1
+        uses: splunk/addonfactory-test-matrix-action@v2.1.8
 
   security-fossa-scan:
     continue-on-error: true

docs/configuration.md

@@ -277,6 +277,16 @@ A syntax error will cause the runtime process to abort in the "preflight" phase
 
 To update your changes, restart SC4S.
 
+### Set source value as 'sc4s'
+
+User can set the source field value to 'sc4s' by using the `SC4S_SET_SOURCE_AS_SC4S` variable.
+
+**Note:** If the source field value is specified in a local parser or the splunk_metadata.csv file, it will take precedence over the `SC4S_SET_SOURCE_AS_SC4S` variable and overwrite the source field value.
+
+| Variable | Values        | Description |
+|----------|---------------|-------------|
+| SC4S_SET_SOURCE_AS_SC4S | yes or no(default) | Set the source field value to 'sc4s'. |
+
 ## Drop all data by IP or subnet (deprecated)
 
 Using `vendor_product_by_source` to null queue is now a deprecated task. See the supported method for dropping data in [Filtering events from output](https://splunk.github.io/splunk-connect-for-syslog/main/sources/#filtering-events-from-output).

package/etc/conf.d/conflib/_splunk/splunkfields.conf

@@ -128,3 +128,8 @@ filter f_is_source_identified{
 filter f_is_agg{
     tags("agg");
 };
+
+filter f_is_proxy_ip{
+    "$HOST" eq "$SOURCEIP"
+    and "$PROXIED_SRCIP" ne ""
+};

package/etc/conf.d/conflib/syslog/app-syslog-fortigate_fortios.conf

@@ -95,6 +95,14 @@ block parser app-syslog-fortigate_fortios() {
         };
    };
 };
+
 application fortinet_fortios[sc4s-syslog] {
+    filter {
+        (
+            message("eventtype=")
+            or message("time=")
+        )
+        and message("devid=")
+    };
 	parser { app-syslog-fortigate_fortios(); };
 };

package/etc/conf.d/conflib/syslog/app-syslog-fortigate_fortiweb.conf

@@ -133,5 +133,15 @@ block parser app-syslog-fortigate_fortiweb() {
    };
 };
 application app-syslog-fortigate_fortiweb[sc4s-syslog] {
+    filter {
+        (
+            message('eventtime=')
+            or (
+                message('date=')
+                and message('time=')
+            )
+        )
+        and message('device_id=')
+    };
 	parser { app-syslog-fortigate_fortiweb(); };
 };

package/etc/conf.d/sources/internal.conf

@@ -114,6 +114,7 @@ source s_internal {
                     or match("Syslog connection closed; fd=" value("MESSAGE"))
                     or match("Syslog connection accepted; fd=" value("MESSAGE"))
                     or match("xml-parser failed; " value("MESSAGE"))
+                    or match("Initializing PROXY protocol source driver" value("MESSAGE"))
                 };
                 rewrite(r_set_dest_splunk_null_queue);
             };           

package/etc/conf.d/sources/source_syslog/plugin.jinja

@@ -114,6 +114,13 @@ source s_{{ port_id }} {
             );
         };
         {%- endif %}
+
+        {%- if use_proxy_connect == True %}
+            rewrite {
+                set("$PROXIED_SRCIP", value("HOST") condition(filter(f_is_proxy_ip)) );
+            };
+        {%- endif %}
+
         if {
             if {
                 parser {
@@ -288,6 +295,11 @@ source s_{{ port_id }} {
             };
         };
 
+        {%- if set_source_sc4s == True %}
+            rewrite {
+                set("sc4s", value(".splunk.source"));
+            };
+        {%- endif %}
 
         rewrite {
             set($FACILITY, value("fields.sc4s_syslog_facility") condition(match('facility' template('`SC4S_DEST_SPLUNK_INDEXED_FIELDS`') type(string) flags(substring))));
@@ -391,6 +403,13 @@ source s_{{ port_id }} {
             {%- endif %}
             {%- endfor %}
         };
+
+        {%- if use_proxy_connect == True %}
+            rewrite {
+                set("$PROXIED_SRCIP", value("HOST") condition(filter(f_is_proxy_ip)) );
+            };
+        {%- endif %}
+
         {%- if vendor and product %}
         parser {
             p_set_netsource_fields(
@@ -475,6 +494,12 @@ source s_{{ port_id }} {
             parser(app-group-sc4s-fallback);
         };
 
+        {%- if set_source_sc4s == True %}
+            rewrite {
+                set("sc4s", value(".splunk.source"));
+            };
+        {%- endif %}
+
         rewrite {
             set($FACILITY, value("fields.sc4s_syslog_facility") condition(match('facility' template('`SC4S_DEST_SPLUNK_INDEXED_FIELDS`') type(string) flags(substring))));
             set($LEVEL, value("fields.sc4s_syslog_severity") condition(match('severity' template('`SC4S_DEST_SPLUNK_INDEXED_FIELDS`') type(string) flags(substring)) ));

package/etc/conf.d/sources/source_syslog/plugin.py

@@ -133,5 +133,6 @@ def normalize_env_variable_input(env_variable: str):
         ebpf_no_sockets=int(os.getenv("SC4S_EBPF_NO_SOCKETS", 4)),
         enable_parallelize=normalize_env_variable_input(f"SC4S_ENABLE_PARALLELIZE"),
         parallelize_no_partitions=int(os.getenv(f"SC4S_PARALLELIZE_NO_PARTITION", 4)),
+        set_source_sc4s=normalize_env_variable_input("SC4S_SET_SOURCE_AS_SC4S"),
     )
     print(outputText)

package/lite/etc/addons/fortinet/app-syslog-fortigate_fortios.conf

@@ -95,6 +95,14 @@ block parser app-syslog-fortigate_fortios() {
         };
    };
 };
+
 application fortinet_fortios[sc4s-syslog] {
+    filter {
+        (
+            message("eventtype=")
+            or message("time=")
+        )
+        and message("devid=")
+    };
 	parser { app-syslog-fortigate_fortios(); };
 };

package/lite/etc/addons/fortinet/app-syslog-fortigate_fortiweb.conf

@@ -133,5 +133,15 @@ block parser app-syslog-fortigate_fortiweb() {
    };
 };
 application app-syslog-fortigate_fortiweb[sc4s-syslog] {
+    filter {
+        (
+            message('eventtime=')
+            or (
+                message('date=')
+                and message('time=')
+            )
+        )
+        and message('device_id=')
+    };
 	parser { app-syslog-fortigate_fortiweb(); };
 };