Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] zeek ecs 1.7 updates for network.direction #22967

Merged
merged 2 commits into from
Dec 10, 2020
Merged

[Filebeat] zeek ecs 1.7 updates for network.direction #22967

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0a768e5
zeek ecs 1.7 updates for network.direction
leehinman Dec 7, 2020
3d3ea47
Merge branch 'master' into 21674_zeek_ingress_egress
leehinman Dec 10, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -344,6 +344,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Fix for `field [source] not present as part of path [source.ip]` error in azure pipelines. {pull}22377[22377]
- Drop aws.vpcflow.pkt_srcaddr and aws.vpcflow.pkt_dstaddr when equal to "-". {pull}22721[22721] {issue}22716[22716]
- Fix cisco umbrella module config by adding input variable. {pull}22892[22892]
- Fix network.direction logic in zeek connection fileset. {pull}22967[22967]
- Convert the o365 module's `client.port` and `source.port` to numbers (from strings) in events. {pull}22939[22939]
- Fix Cisco ASA/FTD module's parsing of WebVPN log message 716002. {pull}22966[22966]

Expand Down
37 changes: 24 additions & 13 deletions x-pack/filebeat/module/zeek/connection/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,19 +45,30 @@ processors:
source: ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes
ignore_failure: true
- script:
source: >-
if (ctx?.zeek?.connection?.local_orig == true) {
if (ctx?.zeek?.connection?.local_resp == true) {
ctx.network.direction = "internal";
} else {
ctx.network.direction = "outbound";
}
} else {
if (ctx?.zeek?.connection?.local_resp == true) {
ctx.network.direction = "inbound";
} else {
ctx.network.direction = "external";
}
source: |-
if (ctx?.zeek?.connection?.local_orig == null ||
ctx?.zeek?.connection?.local_resp == null) {
return;
}
if (ctx.zeek.connection.local_orig == true &&
ctx.zeek.connection.local_resp == true) {
ctx.network.direction = "internal";
return;
}
if (ctx.zeek.connection.local_orig == true &&
ctx.zeek.connection.local_resp == false) {
ctx.network.direction = "outbound";
return;
}
if (ctx.zeek.connection.local_orig == false &&
ctx.zeek.connection.local_resp == true) {
ctx.network.direction = "inbound";
return;
}
if (ctx.zeek.connection.local_orig == false &&
ctx.zeek.connection.local_resp == false) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, wondering what these fields equate to in practice? I'm assuming that they're generally about inbound/outbound network connections that are destined for the host that zeek is running on, right? If so, I'd actually switch this to use ingress/egress. The inbound/outbound stuff is when you're modeling around a network perimeter, like if you have a network firewall or something.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From zeek docs:

local_orig: bool
If the connection is originated locally, this value will be T. If it was originated remotely it will be F. In the case that the Site::local_nets variable is undefined, this field will be left empty at all times.

local_resp: bool
If the connection is responded to locally, this value will be T. If it was responded to remotely it will be F. In the case that the Site::local_nets variable is undefined, this field will be left empty at all times.

So I think inbound/outbound are the right pairs, since you have to define local_nets variable and traffic doesn't have to be to/from the zeek host.

ctx.network.direction = "external";
return;
}
- geoip:
field: destination.ip
Expand Down