zoom: map user.email and participant.public_ip fields to ECS

efd6 · efd6 · commit 1db9b3b1cc94 · 2025-07-11T10:17:49.000+09:30
Also add new field definitions from the API docs[1][2]. Note that public_ip is not listed in the documentation but is observed in provided events (added in tests). [1]https://developers.zoom.us/docs/api/meetings/events/#tag/meeting/POSTmeeting.participant_joined [2]https://developers.zoom.us/docs/api/meetings/events/#tag/webinar/POSTwebinar.participant_joined
diff --git a/packages/zoom/changelog.yml b/packages/zoom/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.23.0"
+  changes:
+    - description: Map `user.email` and `source.ip` from available fields.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/14499
 - version: "1.22.0"
   changes:
     - description: Update Kibana constraint to support 9.0.0.
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json
@@ -148,4 +148,4 @@
             }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json
@@ -234,4 +234,4 @@
             }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json
@@ -126,4 +126,4 @@
             }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json
@@ -416,6 +416,35 @@
                     }
                 }
             }
+        },
+        {
+            "zoom": {
+                "event": "meeting.participant_joined",
+                "event_ts": 1752127174016,
+                "payload": {
+                    "account_id": "HzozXXXXXXXX",
+                    "object": {
+                        "duration": 60,
+                        "host_id": "dNvWUbXXXXXXXXXXXXXX",
+                        "id": "986XXXXXXXX",
+                        "participant": {
+                            "email": "user@elastic",
+                            "id": "8XjrxbGtXXXXXXXXXX",
+                            "join_time": "2025-07-10T05:59:30Z",
+                            "participant_user_id": "8XjrxbGtXXXXXXXXXX",
+                            "participant_uuid": "0E699901-3B16-3698-3388-XXXXXXXXXX",
+                            "public_ip": "81.2.69.144",
+                            "user_id": "123456789",
+                            "user_name": "Display Name of User"
+                        },
+                        "start_time": "2025-07-10T05:57:47Z",
+                        "timezone": "Asia/Seoul",
+                        "topic": "Team Meeting",
+                        "type": 2,
+                        "uuid": "pU/13Hdsdfsdfsdf7xZZzpUg=="
+                    }
+                }
+            }
         }
     ]
 }
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json
@@ -687,6 +687,71 @@
                     "user_name": "shree"
                 }
             }
+        },
+        {
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "meeting.participant_joined",
+                "duration": 3600000000000,
+                "kind": [
+                    "event"
+                ],
+                "type": [
+                    "info"
+                ]
+            },
+            "observer": {
+                "product": "Webhook",
+                "vendor": "Zoom"
+            },
+            "related": {
+                "user": [
+                    "8XjrxbGtXXXXXXXXXX",
+                    "dNvWUbXXXXXXXXXXXXXX"
+                ]
+            },
+            "source": {
+                "geo": {
+                    "city_name": "London",
+                    "continent_name": "Europe",
+                    "country_iso_code": "GB",
+                    "country_name": "United Kingdom",
+                    "location": {
+                        "lat": 51.5142,
+                        "lon": -0.0931
+                    },
+                    "region_iso_code": "GB-ENG",
+                    "region_name": "England"
+                },
+                "ip": "81.2.69.144"
+            },
+            "user": {
+                "email": "user@elastic",
+                "full_name": "Display Name of User",
+                "id": "8XjrxbGtXXXXXXXXXX"
+            },
+            "zoom": {
+                "account_id": "HzozXXXXXXXX",
+                "meeting": {
+                    "host_id": "dNvWUbXXXXXXXXXXXXXX",
+                    "id": "986XXXXXXXX",
+                    "start_time": "2025-07-10T05:57:47Z",
+                    "timezone": "Asia/Seoul",
+                    "topic": "Team Meeting",
+                    "type": 2,
+                    "uuid": "pU/13Hdsdfsdfsdf7xZZzpUg=="
+                },
+                "participant": {
+                    "email": "user@elastic",
+                    "id": "8XjrxbGtXXXXXXXXXX",
+                    "participant_user_id": "8XjrxbGtXXXXXXXXXX",
+                    "participant_uuid": "0E699901-3B16-3698-3388-XXXXXXXXXX",
+                    "user_id": "123456789",
+                    "user_name": "Display Name of User"
+                }
+            }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json
@@ -476,4 +476,4 @@
             }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json
@@ -595,4 +595,4 @@
             }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json
@@ -229,6 +229,23 @@
                     }
                 }
             }
+        },
+        {
+            "zoom": {
+                "event": "user.signed_in",
+                "event_ts": 1752128713153,
+                "payload": {
+                    "account_id": "HzozXXXXXXXX",
+                    "object": {
+                        "client_type": "iphone",
+                        "date_time": "2025-07-10T06:25:13Z",
+                        "email": "username@elastic",
+                        "id": "WYVlJyXXXXXXXXXXXXX",
+                        "login_type": 101,
+                        "version": "6.5.1.25747"
+                    }
+                }
+            }
         }
     ]
 }
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-config.yml b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-config.yml
@@ -2,3 +2,4 @@ dynamic_fields:
   "event.ingested": ".*"
 numeric_keyword_fields:
   - "zoom.user.type"
+  - "zoom.user.login_type"
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json
@@ -594,6 +594,46 @@
                     "version": "4.5.3308.0902"
                 }
             }
+        },
+        {
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "user.signed_in",
+                "category": [
+                    "authentication"
+                ],
+                "kind": [
+                    "event"
+                ],
+                "type": [
+                    "start"
+                ]
+            },
+            "observer": {
+                "product": "Webhook",
+                "vendor": "Zoom"
+            },
+            "related": {
+                "user": [
+                    "WYVlJyXXXXXXXXXXXXX"
+                ]
+            },
+            "user": {
+                "email": "username@elastic",
+                "id": "WYVlJyXXXXXXXXXXXXX"
+            },
+            "zoom": {
+                "account_id": "HzozXXXXXXXX",
+                "user": {
+                    "client_type": "iphone",
+                    "email": "username@elastic",
+                    "id": "WYVlJyXXXXXXXXXXXXX",
+                    "login_type": 101,
+                    "version": "6.5.1.25747"
+                }
+            }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json
@@ -397,6 +397,36 @@
                     "operator": "someemail@email.com"
                 }
             }
+        },
+        {
+            "zoom": {
+                "event": "webinar.participant_joined",
+                "event_ts": 1752041165739,
+                "payload": {
+                    "account_id": "HzozXXXXXXXX",
+                    "object": {
+                        "duration": 120,
+                        "host_id": "xihlAha7S1-X_XXXXXXX",
+                        "id": "123456789",
+                        "participant": {
+                            "email": "",
+                            "id": "",
+                            "join_time": "2025-07-09T06:06:00Z",
+                            "participant_user_id": "",
+                            "participant_uuid": "A319F4C2-4E01-0620-2F76-XXXXXXXXX",
+                            "public_ip": "81.2.69.144",
+                            "registrant_id": "eGw1iUe1QJeXXXXXXXXX",
+                            "user_id": "123456789",
+                            "user_name": "Zoom Person"
+                        },
+                        "start_time": "2025-07-09T04:49:39Z",
+                        "timezone": "Asia/Calcutta",
+                        "topic": "Unlock the Future of Enterprise Security with Elastic AI-Driven Security",
+                        "type": 5,
+                        "uuid": "XXXXXXXXXXXe9IBBJKWQ1KA=="
+                    }
+                }
+            }
         }
     ]
 }
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json
@@ -664,6 +664,67 @@
                     "uuid": "czLF6FFFoQOKgAB99DlDb9g=="
                 }
             }
+        },
+        {
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "webinar.participant_joined",
+                "kind": [
+                    "event"
+                ],
+                "type": [
+                    "info"
+                ]
+            },
+            "observer": {
+                "product": "Webhook",
+                "vendor": "Zoom"
+            },
+            "related": {
+                "user": [
+                    "xihlAha7S1-X_XXXXXXX"
+                ]
+            },
+            "source": {
+                "geo": {
+                    "city_name": "London",
+                    "continent_name": "Europe",
+                    "country_iso_code": "GB",
+                    "country_name": "United Kingdom",
+                    "location": {
+                        "lat": 51.5142,
+                        "lon": -0.0931
+                    },
+                    "region_iso_code": "GB-ENG",
+                    "region_name": "England"
+                },
+                "ip": "81.2.69.144"
+            },
+            "user": {
+                "full_name": "Zoom Person"
+            },
+            "zoom": {
+                "account_id": "HzozXXXXXXXX",
+                "participant": {
+                    "join_time": "2025-07-09T06:06:00Z",
+                    "participant_uuid": "A319F4C2-4E01-0620-2F76-XXXXXXXXX",
+                    "registrant_id": "eGw1iUe1QJeXXXXXXXXX",
+                    "user_id": "123456789",
+                    "user_name": "Zoom Person"
+                },
+                "webinar": {
+                    "duration": 120,
+                    "host_id": "xihlAha7S1-X_XXXXXXX",
+                    "id": "123456789",
+                    "start_time": "2025-07-09T04:49:39Z",
+                    "timezone": "Asia/Calcutta",
+                    "topic": "Unlock the Future of Enterprise Security with Elastic AI-Driven Security",
+                    "type": 5,
+                    "uuid": "XXXXXXXXXXXe9IBBJKWQ1KA=="
+                }
+            }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json
@@ -121,4 +121,4 @@
             }
         }
     ]
-}
+}
diff --git a/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/meeting.yml b/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/meeting.yml
@@ -63,6 +63,10 @@ processors:
     field: user.full_name
     value: '{{{zoom.participant.user_name}}}'
     ignore_empty_value: true
+- set:
+    field: user.email
+    copy_from: zoom.participant.email
+    ignore_empty_value: true
 
 #
 # Set user.id to be the meeting's host, unless already set.
@@ -87,6 +91,36 @@ processors:
     allow_duplicates: false
     if: ctx.zoom?.meeting?.host_id != null
 
+- convert:
+    field: zoom.participant.public_ip
+    target_field: source.ip
+    type: ip
+    if: ctx.zoom?.participant?.public_ip != null && ctx.zoom.participant.public_ip != ''
+    ignore_failure: true
+- remove:
+    field: zoom.participant.public_ip
+    ignore_missing: true
+- geoip:
+    field: source.ip
+    target_field: source.geo
+    ignore_missing: true
+- geoip:
+    database_file: GeoLite2-ASN.mmdb
+    field: source.ip
+    target_field: source.as
+    properties:
+      - asn
+      - organization_name
+    ignore_missing: true
+- rename:
+    field: source.as.asn
+    target_field: source.as.number
+    ignore_missing: true
+- rename:
+    field: source.as.organization_name
+    target_field: source.as.organization.name
+    ignore_missing: true
+
 - date:
     field: zoom.meeting.start_time
     target_field: event.start
diff --git a/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/user.yml b/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/user.yml
diff --git a/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/webinar.yml b/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/webinar.yml
diff --git a/packages/zoom/data_stream/webhook/fields/fields.yml b/packages/zoom/data_stream/webhook/fields/fields.yml
diff --git a/packages/zoom/docs/README.md b/packages/zoom/docs/README.md
diff --git a/packages/zoom/manifest.yml b/packages/zoom/manifest.yml

Original file line number	Diff line number	Diff line change
`@@ -148,4 +148,4 @@`
`148`	`148`	`}`
`149`	`149`	`}`
`150`	`150`	`]`
`151`		`-}`
	`151`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -234,4 +234,4 @@`
`234`	`234`	`}`
`235`	`235`	`}`
`236`	`236`	`]`
`237`		`-}`
	`237`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -126,4 +126,4 @@`
`126`	`126`	`}`
`127`	`127`	`}`
`128`	`128`	`]`
`129`		`-}`
	`129`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -476,4 +476,4 @@`
`476`	`476`	`}`
`477`	`477`	`}`
`478`	`478`	`]`
`479`		`-}`
	`479`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -595,4 +595,4 @@`
`595`	`595`	`}`
`596`	`596`	`}`
`597`	`597`	`]`
`598`		`-}`
	`598`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -229,6 +229,23 @@`
`229`	`229`	`}`
`230`	`230`	`}`
`231`	`231`	`}`
	`232`	`+ },`
	`233`	`+ {`
	`234`	`+ "zoom": {`
	`235`	`+ "event": "user.signed_in",`
	`236`	`+ "event_ts": 1752128713153,`
	`237`	`+ "payload": {`
	`238`	`+ "account_id": "HzozXXXXXXXX",`
	`239`	`+ "object": {`
	`240`	`+ "client_type": "iphone",`
	`241`	`+ "date_time": "2025-07-10T06:25:13Z",`
	`242`	`+ "email": "username@elastic",`
	`243`	`+ "id": "WYVlJyXXXXXXXXXXXXX",`
	`244`	`+ "login_type": 101,`
	`245`	`+ "version": "6.5.1.25747"`
	`246`	`+ }`
	`247`	`+ }`
	`248`	`+ }`
`232`	`249`	`}`
`233`	`250`	`]`
`234`	`251`	`}`