[Filebeat] Update zeek module to ECS 1.4 #16029
Assignees
Labels
Comments
|
Pinging @elastic/siem (Team:SIEM) |
leehinman
changed the title
3 tasks
leehinman
added a commit
to leehinman/beats
that referenced
this issue
Apr 15, 2020
- capture_loss + convert pipeline to yaml + event.kind + event.type - connection + convert pipeline to yaml + event.kind + event.category + event.type + related.ip - dce_rpc + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + source.geo + destination.geo - dhcp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip - dnp3 + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + source.geo + destination.geo + source.as + destiantion.as - dns + event.kind + event.category + event.type + event.outcome + dns.question.top_level_domain + related.ip - dpd + convert pipeline to yaml + event.kind + event.category + event.type + source.geo + destiantion.geo + source.as + destiantion.as + related.ip - files + convert pipeline to yaml + event.kind + event.category + event.type + file.mime_type + file.name + file.hash.md5 + file.hash.sha1 + file.hash.sha256 + client.ip + server.ip + related.ip + related.hash - ftp + convert pipeline to yaml + event.kind + event.category + event.type + event.action + user.name + file.mime_type + file.size + related.ip + related.user + source.geo + destination.geo - http + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + url.port type to number + http.request.method lowercase + related.ip + related.users - intel + event.kind + event.type + related.ip - irc + convert pipeline to yaml + event.kind + event.category + event.type + event.action + user.name + file.name + file.size + file.mime_type + related.ip + related.user + source.geo + destination.geo - kerberos + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + user.name + user.domain + source.geo + destination.geo + related.ip + related.user - modbus + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + source.geo + destination.geo - mysql + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + source.geo + destiantion.geo + related.ip - notice + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + file.size + file.mime_type + rule.description + rule.name - ntlm + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + user.name + user.domain + source.geo + destination.geo + related.ip + related.user - ocsp + convert pipeline to yaml + event.kind + related.hash - pe + convert pipeline to yaml + event.kind + event.category + event.type - radius + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + user.name + source.geo + destination.geo + related.ip + related.user - rdp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - rfb + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - sip + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + source.geo + destination.geo + url.full - smb_cmd + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + related.user + source.geo + destination.geo + user.name - smb_files + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + related.user + source.geo + destination.geo + user.name + file.accessed + file.ctime + file.created + file.mtime + file.path + file.name + file.size - smb_mapping + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - smtp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - snmp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - socks + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + related.ip + source.geo + destination.geo + user.name + related.user - ssh + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + related.ip + source.geo + destination.geo - ssl + event.kind + event.category + event.type + related.ip - stats + convert pipeline to yaml + event.kind - syslog + convert pipeline to yaml + event.kind + related.ip + source.geo + destination.geo + log.syslog.facility.name + log.syslog.severity.name - traceroute + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - tunnel + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - weird + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo + rule.name - x509 + event.kind + event.type Closes elastic#16029
leehinman
added a commit
that referenced
this issue
Apr 29, 2020
…17738) * Improve ECS categorization field mappings for zeek module - capture_loss + convert pipeline to yaml + event.kind + event.type - connection + convert pipeline to yaml + event.kind + event.category + event.type + related.ip - dce_rpc + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + source.geo + destination.geo - dhcp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip - dnp3 + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + source.geo + destination.geo + source.as + destiantion.as - dns + event.kind + event.category + event.type + event.outcome + dns.question.top_level_domain + related.ip - dpd + convert pipeline to yaml + event.kind + event.category + event.type + source.geo + destiantion.geo + source.as + destiantion.as + related.ip - files + convert pipeline to yaml + event.kind + event.category + event.type + file.mime_type + file.name + file.hash.md5 + file.hash.sha1 + file.hash.sha256 + client.ip + server.ip + related.ip + related.hash - ftp + convert pipeline to yaml + event.kind + event.category + event.type + event.action + user.name + file.mime_type + file.size + related.ip + related.user + source.geo + destination.geo - http + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + url.port type to number + http.request.method lowercase + related.ip + related.users - intel + event.kind + event.type + related.ip - irc + convert pipeline to yaml + event.kind + event.category + event.type + event.action + user.name + file.name + file.size + file.mime_type + related.ip + related.user + source.geo + destination.geo - kerberos + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + user.name + user.domain + source.geo + destination.geo + related.ip + related.user - modbus + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + source.geo + destination.geo - mysql + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + source.geo + destiantion.geo + related.ip - notice + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + file.size + file.mime_type + rule.description + rule.name - ntlm + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + user.name + user.domain + source.geo + destination.geo + related.ip + related.user - ocsp + convert pipeline to yaml + event.kind + related.hash - pe + convert pipeline to yaml + event.kind + event.category + event.type - radius + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + user.name + source.geo + destination.geo + related.ip + related.user - rdp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - rfb + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - sip + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + source.geo + destination.geo + url.full - smb_cmd + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + related.user + source.geo + destination.geo + user.name - smb_files + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + related.user + source.geo + destination.geo + user.name + file.accessed + file.ctime + file.created + file.mtime + file.path + file.name + file.size - smb_mapping + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - smtp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - snmp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - socks + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + related.ip + source.geo + destination.geo + user.name + related.user - ssh + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + related.ip + source.geo + destination.geo - ssl + event.kind + event.category + event.type + related.ip - stats + convert pipeline to yaml + event.kind - syslog + convert pipeline to yaml + event.kind + related.ip + source.geo + destination.geo + log.syslog.facility.name + log.syslog.severity.name - traceroute + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - tunnel + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - weird + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo + rule.name - x509 + event.kind + event.type Closes #16029
3 tasks
leehinman
added a commit
to leehinman/beats
that referenced
this issue
Apr 29, 2020
…lastic#17738) * Improve ECS categorization field mappings for zeek module - capture_loss + convert pipeline to yaml + event.kind + event.type - connection + convert pipeline to yaml + event.kind + event.category + event.type + related.ip - dce_rpc + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + source.geo + destination.geo - dhcp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip - dnp3 + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + source.geo + destination.geo + source.as + destiantion.as - dns + event.kind + event.category + event.type + event.outcome + dns.question.top_level_domain + related.ip - dpd + convert pipeline to yaml + event.kind + event.category + event.type + source.geo + destiantion.geo + source.as + destiantion.as + related.ip - files + convert pipeline to yaml + event.kind + event.category + event.type + file.mime_type + file.name + file.hash.md5 + file.hash.sha1 + file.hash.sha256 + client.ip + server.ip + related.ip + related.hash - ftp + convert pipeline to yaml + event.kind + event.category + event.type + event.action + user.name + file.mime_type + file.size + related.ip + related.user + source.geo + destination.geo - http + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + url.port type to number + http.request.method lowercase + related.ip + related.users - intel + event.kind + event.type + related.ip - irc + convert pipeline to yaml + event.kind + event.category + event.type + event.action + user.name + file.name + file.size + file.mime_type + related.ip + related.user + source.geo + destination.geo - kerberos + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + user.name + user.domain + source.geo + destination.geo + related.ip + related.user - modbus + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + source.geo + destination.geo - mysql + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + source.geo + destiantion.geo + related.ip - notice + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + file.size + file.mime_type + rule.description + rule.name - ntlm + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + user.name + user.domain + source.geo + destination.geo + related.ip + related.user - ocsp + convert pipeline to yaml + event.kind + related.hash - pe + convert pipeline to yaml + event.kind + event.category + event.type - radius + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + user.name + source.geo + destination.geo + related.ip + related.user - rdp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - rfb + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - sip + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + source.geo + destination.geo + url.full - smb_cmd + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + related.user + source.geo + destination.geo + user.name - smb_files + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + related.user + source.geo + destination.geo + user.name + file.accessed + file.ctime + file.created + file.mtime + file.path + file.name + file.size - smb_mapping + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - smtp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - snmp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - socks + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + related.ip + source.geo + destination.geo + user.name + related.user - ssh + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + related.ip + source.geo + destination.geo - ssl + event.kind + event.category + event.type + related.ip - stats + convert pipeline to yaml + event.kind - syslog + convert pipeline to yaml + event.kind + related.ip + source.geo + destination.geo + log.syslog.facility.name + log.syslog.severity.name - traceroute + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - tunnel + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - weird + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo + rule.name - x509 + event.kind + event.type Closes elastic#16029 (cherry picked from commit b552dd8)
leehinman
added a commit
that referenced
this issue
May 4, 2020
…17738) (#18076) * Improve ECS categorization field mappings for zeek module - capture_loss + convert pipeline to yaml + event.kind + event.type - connection + convert pipeline to yaml + event.kind + event.category + event.type + related.ip - dce_rpc + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + source.geo + destination.geo - dhcp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip - dnp3 + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + source.geo + destination.geo + source.as + destiantion.as - dns + event.kind + event.category + event.type + event.outcome + dns.question.top_level_domain + related.ip - dpd + convert pipeline to yaml + event.kind + event.category + event.type + source.geo + destiantion.geo + source.as + destiantion.as + related.ip - files + convert pipeline to yaml + event.kind + event.category + event.type + file.mime_type + file.name + file.hash.md5 + file.hash.sha1 + file.hash.sha256 + client.ip + server.ip + related.ip + related.hash - ftp + convert pipeline to yaml + event.kind + event.category + event.type + event.action + user.name + file.mime_type + file.size + related.ip + related.user + source.geo + destination.geo - http + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + url.port type to number + http.request.method lowercase + related.ip + related.users - intel + event.kind + event.type + related.ip - irc + convert pipeline to yaml + event.kind + event.category + event.type + event.action + user.name + file.name + file.size + file.mime_type + related.ip + related.user + source.geo + destination.geo - kerberos + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + user.name + user.domain + source.geo + destination.geo + related.ip + related.user - modbus + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + source.geo + destination.geo - mysql + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + source.geo + destiantion.geo + related.ip - notice + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + file.size + file.mime_type + rule.description + rule.name - ntlm + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + user.name + user.domain + source.geo + destination.geo + related.ip + related.user - ocsp + convert pipeline to yaml + event.kind + related.hash - pe + convert pipeline to yaml + event.kind + event.category + event.type - radius + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + user.name + source.geo + destination.geo + related.ip + related.user - rdp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - rfb + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - sip + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + source.geo + destination.geo + url.full - smb_cmd + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + event.action + related.ip + related.user + source.geo + destination.geo + user.name - smb_files + convert pipeline to yaml + event.kind + event.category + event.type + event.action + related.ip + related.user + source.geo + destination.geo + user.name + file.accessed + file.ctime + file.created + file.mtime + file.path + file.name + file.size - smb_mapping + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - smtp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - snmp + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - socks + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + related.ip + source.geo + destination.geo + user.name + related.user - ssh + convert pipeline to yaml + event.kind + event.category + event.type + event.outcome + related.ip + source.geo + destination.geo - ssl + event.kind + event.category + event.type + related.ip - stats + convert pipeline to yaml + event.kind - syslog + convert pipeline to yaml + event.kind + related.ip + source.geo + destination.geo + log.syslog.facility.name + log.syslog.severity.name - traceroute + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - tunnel + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo - weird + convert pipeline to yaml + event.kind + event.category + event.type + related.ip + source.geo + destination.geo + rule.name - x509 + event.kind + event.type Closes #16029 (cherry picked from commit b552dd8)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Filesets
Look at:
The text was updated successfully, but these errors were encountered: