Skip to content

[snort] Format {source,destination}.mac per ECS #3301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andrewkroh merged 10 commits into from
May 10, 2022
Merged

[snort] Format {source,destination}.mac per ECS #3301

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
7328c82
Sort ecs.yml
andrewkroh May 9, 2022
79b5661
Add missing event field mappings
andrewkroh May 9, 2022
6ed3d10
Fix lint error for @timestamp
andrewkroh May 9, 2022
7380a44
Remove duplicate host.ip definition
andrewkroh May 9, 2022
67bf900
Use ECS for {source,destination}.geo.location
andrewkroh May 9, 2022
d6c3923
Format source.mac, destination.mac as per ECS
andrewkroh May 9, 2022
421270f
Update elastic/stream
andrewkroh May 9, 2022
b2d7d55
Update sample event
andrewkroh May 9, 2022
0ca08c7
Update readme and generate pipeline test files
andrewkroh May 9, 2022
25c17f3
Update changelog
andrewkroh May 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
Sort ecs.yml 
[git-generate]
cd packages/snort
yq -i '. | sort_by(.name) | sort_keys(..)' data_stream/log/fields/ecs.yml
  • Loading branch information
@andrewkroh
andrewkroh committed May 9, 2022
commit 7328c826f74a7c6e83ba13c4c87ad82d017b49cf
46 changes: 23 additions & 23 deletions packages/snort/data_stream/log/fields/ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,32 +42,52 @@
name: event.severity
- external: ecs
name: host.ip
- external: ecs
name: log.file.path
- external: ecs
name: message
- external: ecs
name: network.community_id
- external: ecs
name: network.direction
- external: ecs
name: network.protocol
- external: ecs
name: network.transport
- external: ecs
name: network.type
- external: ecs
name: network.direction
name: observer.ip
- external: ecs
name: observer.name
- external: ecs
name: observer.product
- external: ecs
name: observer.type
- external: ecs
name: observer.vendor
- external: ecs
name: process.name
- external: ecs
name: process.pid
- external: ecs
name: related.ip
- external: ecs
name: rule.category
- external: ecs
name: rule.description
- external: ecs
name: rule.id
- external: ecs
name: rule.name
- external: ecs
name: rule.description
- external: ecs
name: rule.version
- external: ecs
name: source.address
- external: ecs
name: source.as.number
- external: ecs
name: source.as.organization.name
- external: ecs
name: source.bytes
- external: ecs
Expand All @@ -94,25 +114,5 @@
name: source.packets
- external: ecs
name: source.port
- external: ecs
name: source.as.number
- external: ecs
name: source.as.organization.name
- external: ecs
name: tags
- external: ecs
name: observer.name
- external: ecs
name: observer.ip
- external: ecs
name: observer.vendor
- external: ecs
name: observer.type
- external: ecs
name: observer.product
- external: ecs
name: process.name
- external: ecs
name: process.pid
- external: ecs
name: log.file.path