Skip to content

Commit

Permalink
Cherry-pick #20220 to 7.x: [Filebeat] Updates to Suricata module (#20484
Browse files Browse the repository at this point in the history
)

* [Filebeat] Updates to Suricata module (#20220)

* Updates to Suricata module

- Fix convert processor fail_on_error parameter naming.
- Add event.ingested to ingest node pipeline.
- Remove ECS suffixing from dashboard/viz titles.
- Prioritize using ECS fields in dashboards.
- Add Suricata logo to dashboards.

* Always remove event.ingested from test data

(cherry picked from commit 0659a12)

* Update Suricata dashboards (#20394)

This is a followup to #20220 to get the correct dashboard files into place.

(cherry picked from commit b671339)
  • Loading branch information
andrewkroh authored Aug 11, 2020
1 parent 9dff318 commit 0aa391f
Show file tree
Hide file tree
Showing 9 changed files with 1,014 additions and 441 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -588,6 +588,7 @@ field. You can revert this change by configuring tags for the module and omittin
- Add experimental dataset zscaler/zia for Zscaler Internet Access logs {pull}19713[19713]
- Add event.ingested for CrowdStrike module {pull}20138[20138]
- Add support for additional fields and FirewallMatchEvent type events in CrowdStrike module {pull}20138[20138]
- Add event.ingested for Suricata module {pull}20220[20220]

*Heartbeat*

Expand Down
Binary file modified filebeat/docs/images/filebeat-suricata-alerts.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified filebeat/docs/images/filebeat-suricata-events.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
4 changes: 1 addition & 3 deletions filebeat/tests/system/test_modules.py
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,7 @@ def clean_keys(obj):
host_keys.append("host.name")

# The create timestamps area always new
time_keys = ["event.created"]
time_keys = ["event.created", "event.ingested"]
# source path and agent.version can be different for each run
other_keys = ["log.file.path", "agent.version"]
# ECS versions change for any ECS release, large or small
Expand Down Expand Up @@ -284,8 +284,6 @@ def clean_keys(obj):
delete_key(obj, "@timestamp")
# Also remove alternate time field from rsa parsers.
delete_key(obj, "rsa.time.event_time")
# Remove event.ingested from testing, as it will never be the same.
delete_key(obj, "event.ingested")
else:
# excluded events need to have their filename saved to the expected.json
# so that the exception mechanism can be triggered when the json is
Expand Down
Loading

0 comments on commit 0aa391f

Please sign in to comment.