Skip to content

[pfsense] Format client.mac per ECS #3303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andrewkroh merged 8 commits into from
May 10, 2022
Merged

[pfsense] Format client.mac per ECS #3303

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
da37c02
Format client.mac per ECS
andrewkroh May 9, 2022
816f183
Sort ecs.yml
andrewkroh May 9, 2022
fe5908c
Use ECS source.geo.location definition
andrewkroh May 9, 2022
f7a738f
Remove duplicated client.geo.country_iso_code field
andrewkroh May 9, 2022
bc141f3
Remove duplicated pfsense.icmp.{id,seq} fields
andrewkroh May 9, 2022
4c63f7c
Updates sample_event.json
andrewkroh May 9, 2022
7d0317d
Update readme and generated test files
andrewkroh May 9, 2022
4d54ee9
Update changelog
andrewkroh May 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update readme and generated test files 
[git-generate]
cd packages/pfsense
elastic-package build
elastic-package test pipeline -g
  • Loading branch information
@andrewkroh
andrewkroh committed May 9, 2022
commit 7d0317daabecc5a69171ab739492f7a73d118c84
4 changes: 2 additions & 2 deletions packages/pfsense/data_stream/log/_dev/test/pipeline/test-opensense.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,7 @@
{
"@timestamp": "2022-12-31T22:06:16.000-04:00",
"client": {
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"destination": {
Expand Down Expand Up @@ -249,7 +249,7 @@
"port": 67
},
"source": {
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"tags": [
Expand Down
16 changes: 8 additions & 8 deletions packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-dhcp.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
{
"@timestamp": "2022-07-04T09:39:40.000-04:00",
"client": {
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"destination": {
Expand Down Expand Up @@ -57,7 +57,7 @@
"port": 67
},
"source": {
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"tags": [
Expand All @@ -69,7 +69,7 @@
"client": {
"address": "10.150.60.56",
"ip": "10.150.60.56",
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"destination": {
Expand Down Expand Up @@ -135,7 +135,7 @@
"source": {
"address": "10.150.60.56",
"ip": "10.150.60.56",
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"tags": [
Expand All @@ -147,7 +147,7 @@
"client": {
"address": "10.150.60.56",
"ip": "10.150.60.56",
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"destination": {
Expand Down Expand Up @@ -219,7 +219,7 @@
"source": {
"address": "10.150.60.56",
"ip": "10.150.60.56",
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"tags": [
Expand All @@ -231,7 +231,7 @@
"client": {
"address": "10.150.60.56",
"ip": "10.150.60.56",
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"destination": {
Expand Down Expand Up @@ -297,7 +297,7 @@
"source": {
"address": "10.150.60.56",
"ip": "10.150.60.56",
"mac": "4c:55:41:a0:fa:99",
"mac": "4C-55-41-A0-FA-99",
"port": 68
},
"tags": [
Expand Down
19 changes: 12 additions & 7 deletions packages/pfsense/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ An example event for `log` looks as following:
"id": "584f3aea-648c-4e58-aba4-32b8f88d4396",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.0.0-beta1"
"version": "8.2.0"
},
"data_stream": {
"dataset": "pfsense.log",
Expand Down Expand Up @@ -81,7 +81,7 @@ An example event for `log` looks as following:
"elastic_agent": {
"id": "584f3aea-648c-4e58-aba4-32b8f88d4396",
"snapshot": false,
"version": "8.0.0-beta1"
"version": "8.2.0"
},
"event": {
"action": "block",
Expand All @@ -90,8 +90,7 @@ An example event for `log` looks as following:
"network"
],
"dataset": "pfsense.log",
"id": "72237",
"ingested": "2022-02-03T09:44:29Z",
"ingested": "2022-05-09T17:35:12Z",
"kind": "event",
"original": "\u003c134\u003e1 2021-07-03T19:10:14.578288-05:00 pfSense.example.com filterlog 72237 - - 146,,,1535324496,igb1.12,match,block,in,4,0x0,,63,32989,0,DF,6,tcp,60,10.170.12.50,175.16.199.1,49652,853,0,S,1818117648,,64240,,mss;sackOK;TS;nop;wscale\n",
"provider": "filterlog",
Expand All @@ -107,7 +106,7 @@ An example event for `log` looks as following:
},
"log": {
"source": {
"address": "172.19.0.7:54953"
"address": "172.18.0.4:58663"
},
"syslog": {
"priority": 134
Expand All @@ -131,7 +130,9 @@ An example event for `log` looks as following:
"id": "12"
}
},
"name": "pfSense.example.com"
"name": "pfSense.example.com",
"type": "firewall",
"vendor": "netgate"
},
"pfsense": {
"ip": {
Expand All @@ -154,6 +155,10 @@ An example event for `log` looks as following:
"window": 64240
}
},
"process": {
"name": "filterlog",
"pid": 72237
},
"related": {
"ip": [
"175.16.199.1",
Expand Down Expand Up @@ -333,7 +338,7 @@ An example event for `log` looks as following:
| pfsense.icmp.parameter | ICMP parameter. | long |
| pfsense.icmp.redirect | ICMP redirect address. | ip |
| pfsense.icmp.rtime | Receive Timestamp | date |
| pfsense.icmp.seq | Sequence number of the echo request/reply | long |
| pfsense.icmp.seq | ICMP sequence number. | long |
| pfsense.icmp.ttime | Transmit Timestamp | date |
| pfsense.icmp.type | ICMP type. | keyword |
| pfsense.icmp.unreachable.iana_number | Protocol ID number that was unreachable | long |
Expand Down