Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Suricata] Update fields and paths #8550

Merged
merged 16 commits into from
Oct 16, 2018
Merged

[Suricata] Update fields and paths #8550

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
957aa9a
Update eve.json paths
adriansr Oct 3, 2018
d5e1b31
Remove ecs prefix from fields, some renames and http fields
adriansr Oct 3, 2018
91044eb
Added region_iso_code to geolocation fields
adriansr Oct 4, 2018
8b1b1a6
Create source_ecs for 6.x compatibility
adriansr Oct 4, 2018
1eb261a
Update dashboards fields
adriansr Oct 4, 2018
d17d60c
Restore src_ip and dest_ip fields
adriansr Oct 4, 2018
9953493
Added fields to suricata.eve
adriansr Oct 4, 2018
7e0c95a
Replace usages of set/painless with convert
adriansr Oct 4, 2018
a2ced16
Populate ECS fields only if source exists
adriansr Oct 4, 2018
9c74b65
Replace painless with convert
adriansr Oct 8, 2018
04d1704
More fields from long running suricata
adriansr Oct 9, 2018
2ce28b8
Update fields in Alert dashboard
adriansr Oct 9, 2018
2233e01
Update overview dashboard
adriansr Oct 9, 2018
26bd7c5
Missing source and destination port fields
adriansr Oct 11, 2018
60c6532
Use ECS fields in suricata dashboards' saved searches
adriansr Oct 16, 2018
dd0d4e9
Remove uninteresting suricata fields
adriansr Oct 16, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 85 additions & 0 deletions filebeat/_meta/fields.common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,3 +100,88 @@
description: >
Content length of the HTTP response body.

- name: source_ecs
webmat marked this conversation as resolved.
Show resolved Hide resolved
type: group
fields:
- name: ip
type: ip
description: >
IP address of the source.

- name: port
type: long
description: >
Port of the source.

- name: geo
type: group
description:
Geolocation for source.
fields:
- name: continent_name
type: keyword
description: >
Name of the continent.

- name: country_iso_code
type: keyword
description: >
Country ISO code.

- name: location
type: geo_point
description: >
Longitude and latitude.

- name: region_name
type: keyword
description: >
Region name.

- name: city_name
type: keyword
description: >
City name.

- name: region_iso_code
type: keyword
description: >
Region ISO code.

- name: destination
type: group
fields:
- name: geo
type: group
description:
Geolocation for destination.
fields:
- name: continent_name
type: keyword
description: >
Name of the continent.

- name: country_iso_code
type: keyword
description: >
Country ISO code.

- name: location
type: geo_point
description: >
Longitude and latitude.

- name: region_name
type: keyword
description: >
Region name.

- name: city_name
type: keyword
description: >
City name.

- name: region_iso_code
type: keyword
description: >
Region ISO code.
154 changes: 154 additions & 0 deletions filebeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4718,6 +4718,160 @@ type: long
Content length of the HTTP response body.


--


*`source_ecs.ip`*::
+
--
type: ip

IP address of the source.


--

*`source_ecs.port`*::
+
--
type: long

Port of the source.


--

[float]
== geo fields

Geolocation for source.


*`source_ecs.geo.continent_name`*::
+
--
type: keyword

Name of the continent.


--

*`source_ecs.geo.country_iso_code`*::
+
--
type: keyword

Country ISO code.


--

*`source_ecs.geo.location`*::
+
--
type: geo_point

Longitude and latitude.


--

*`source_ecs.geo.region_name`*::
+
--
type: keyword

Region name.


--

*`source_ecs.geo.city_name`*::
+
--
type: keyword

City name.


--

*`source_ecs.geo.region_iso_code`*::
+
--
type: keyword

Region ISO code.


--


[float]
== geo fields

Geolocation for destination.


*`destination.geo.continent_name`*::
+
--
type: keyword

Name of the continent.


--

*`destination.geo.country_iso_code`*::
+
--
type: keyword

Country ISO code.


--

*`destination.geo.location`*::
+
--
type: geo_point

Longitude and latitude.


--

*`destination.geo.region_name`*::
+
--
type: keyword

Region name.


--

*`destination.geo.city_name`*::
+
--
type: keyword

City name.


--

*`destination.geo.region_iso_code`*::
+
--
type: keyword

Region ISO code.


--

[[exported-fields-logstash]]
Expand Down
2 changes: 1 addition & 1 deletion filebeat/include/fields.go
View file
Open in desktop

Large diffs are not rendered by default.

26 changes: 13 additions & 13 deletions ...k/filebeat/module/suricata/_meta/kibana/6/dashboard/Filebeat-Suricata-Alert-Overview.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,12 +226,12 @@
"columns": [
"host.name",
"suricata.eve.flow_id",
"suricata.eve.src_ip",
"suricata.eve.src_port",
"suricata.eve.dest_ip",
"suricata.eve.dest_port",
"ecs.source.geo.country_iso_code",
"ecs.destination.geo.country_iso_code"
"source_ecs.ip",
"source_ecs.port",
"destination.ip",
"destination.port",
"source_ecs.geo.country_iso_code",
"destination.geo.country_iso_code"
],
"description": "",
"hits": 0,
Expand All @@ -246,7 +246,7 @@
"alias": null,
"disabled": false,
"index": "filebeat-*",
"key": "ecs.event.type",
"key": "event.type",
"negate": false,
"params": {
"query": "alert",
Expand All @@ -257,7 +257,7 @@
},
"query": {
"match": {
"ecs.event.type": {
"event.type": {
"query": "alert",
"type": "phrase"
}
Expand Down Expand Up @@ -342,7 +342,7 @@
"id": "2",
"params": {
"autoPrecision": true,
"field": "suricata.eve.src_geo.location",
"field": "source_ecs.geo.location",
"isFilteredByCollar": true,
"precision": 2,
"useGeocentroid": true
Expand Down Expand Up @@ -428,7 +428,7 @@
"id": "2",
"params": {
"autoPrecision": true,
"field": "suricata.eve.dest_geo.location",
"field": "destination.geo.location",
"isFilteredByCollar": true,
"precision": 2,
"useGeocentroid": true
Expand Down Expand Up @@ -523,7 +523,7 @@
"id": "2",
"params": {
"customLabel": "Source Country",
"field": "suricata.eve.dest_geo.country_iso_code",
"field": "destination.geo.country_iso_code",
"missingBucket": false,
"missingBucketLabel": "Missing",
"order": "desc",
Expand Down Expand Up @@ -595,7 +595,7 @@
"id": "2",
"params": {
"customLabel": "Source Country",
"field": "suricata.eve.src_geo.country_iso_code",
"field": "source_ecs.geo.country_iso_code",
"missingBucket": false,
"missingBucketLabel": "Missing",
"order": "desc",
Expand Down Expand Up @@ -771,4 +771,4 @@
}
],
"version": "6.3.0"
}
}
Loading