Add panw.panos.endreason field (#18705) (#20531)

PANW firewalls expone why a session is ended (endreason). Currenlty it's not tracked. End reason is important to track down why a specific session is ended (timeout, rst from client/server...). This adds panw.panos.endreason. Co-authored-by: Andrea Dainese <[email protected]> Co-authored-by: Adrian Serrano <[email protected]> (cherry picked from commit 6c0c3bf) Co-authored-by: dainok <[email protected]>
elastic · Aug 11, 2020 · ba9c7a1 · ba9c7a1
1 parent 0aa391f
commit ba9c7a1
Show file tree

Hide file tree

Showing 6 changed files with 118 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -76,6 +76,7 @@ field. You can revert this change by configuring tags for the module and omittin
 - Adds Gsuite Groups support. {pull}19725[19725]
 - Move file metrics to dataset endpoint {pull}19977[19977]
 - Disable the option of running --machine-learning on its own. {pull}20241[20241]
+- Tracking session end reason in panw module. {pull}18705[18705]
 
 *Heartbeat*
 

diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
@@ -105249,6 +105249,16 @@ type: long
 
 --
 
+*`panw.panos.endreason`*::
++
+--
+The reason a session terminated.
+
+
+type: keyword
+
+--
+
 [float]
 === network
 

diff --git a/x-pack/filebeat/module/panw/fields.go b/x-pack/filebeat/module/panw/fields.go
diff --git a/x-pack/filebeat/module/panw/panos/_meta/fields.yml b/x-pack/filebeat/module/panw/panos/_meta/fields.yml
@@ -61,6 +61,11 @@
               description: >
                 Post-NAT destination port.
 
+    - name: endreason
+      type: keyword
+      description: >
+        The reason a session terminated.
+
     - name: network
       type: group
       description: >

diff --git a/x-pack/filebeat/module/panw/panos/config/input.yml b/x-pack/filebeat/module/panw/panos/config/input.yml
@@ -101,6 +101,7 @@ processors:
         source.packets: 44
         server.packets: 45
         destination.packets: 45
+        panw.panos.endreason: 46
         observer.hostname: 52
 
   - extract_array: