-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Packetbeat] Update ingress/egress traffic directionality #22996
[Packetbeat] Update ingress/egress traffic directionality #22996
Conversation
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the default configuration, would it make sense to change the logic for when the add_host_metadata
is executed to be based on the network.direction values. I was wondering if we could use a value of ingress/egress
to trigger it since they mean the packet involved the host packetbeat is running on.
I'd be fine with that. On the other hand, I believe pretty much all other beats use |
That's true. Let's hold off on that change. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CHANGELOG look off, but code changes look good.
) * [Packetbeat] Update ingress/egress traffic directionality * Fix yml indentation * Fix up changelog * rename to internal_networks and use network conditions * Fix up broken link * Stupid bad merges * Re-add eroneously deleted entry (cherry picked from commit cc2dd9f)
… directionality (#23048) * [Packetbeat] Update ingress/egress traffic directionality (#22996) * [Packetbeat] Update ingress/egress traffic directionality * Fix yml indentation * Fix up changelog * rename to internal_networks and use network conditions * Fix up broken link * Stupid bad merges * Re-add eroneously deleted entry (cherry picked from commit cc2dd9f) * Fix changelog
What does this PR do?
This changes the way Packetbeat classifies network directionality to bring it in line with ECS 1.7. It adds a
home_networks
option to the configuration and works like the following:home_networks
is specified, we try to classify at the network perimeterhome_networks
is not specified, then the direction remains "unknown"Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Related issues