Changes network to use ECS fields (#44392) (#44549)

* Change network to use ECS fields * Updated functional tests with new field mapping and data
elastic · Aug 30, 2019 · 44e0234 · 44e0234
1 parent 2e2b9b0
commit 44e0234
Show file tree

Hide file tree

Showing 7 changed files with 6 additions and 6 deletions.
diff --git a/x-pack/legacy/plugins/siem/public/components/page/network/network_dns_table/columns.tsx b/x-pack/legacy/plugins/siem/public/components/page/network/network_dns_table/columns.tsx
@@ -47,7 +47,7 @@ export const getNetworkDnsColumns = (type: networkModel.NetworkType): NetworkDns
               excluded: false,
               kqlQuery: '',
               queryMatch: {
-                field: 'dns.question.etld_plus_one',
+                field: 'dns.question.registered_domain',
                 value: dnsName,
                 operator: IS_OPERATOR,
               },

diff --git a/x-pack/legacy/plugins/siem/server/lib/network/query_dns.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/network/query_dns.dsl.ts
@@ -35,7 +35,7 @@ const getQueryOrder = (networkDnsSortField: NetworkDnsSortField): QueryOrder =>
 const getCountAgg = () => ({
   dns_count: {
     cardinality: {
-      field: 'dns.question.etld_plus_one',
+      field: 'dns.question.registered_domain',
     },
   },
 });
@@ -87,7 +87,7 @@ export const buildDnsQuery = ({
         ...getCountAgg(),
         dns_name_query_count: {
           terms: {
-            field: 'dns.question.etld_plus_one',
+            field: 'dns.question.registered_domain',
             size: querySize,
             order: {
               ...getQueryOrder(networkDnsSortField),

diff --git a/x-pack/test/functional/es_archives/packetbeat/default/mappings.json b/x-pack/test/functional/es_archives/packetbeat/default/mappings.json
@@ -3160,7 +3160,7 @@
             "dns.question.name",
             "dns.question.type",
             "dns.question.class",
-            "dns.question.etld_plus_one",
+            "dns.question.registered_domain",
             "dns.answers.name",
             "dns.answers.type",
             "dns.answers.class",

diff --git a/x-pack/test/functional/es_archives/packetbeat/dns/data.json.gz b/x-pack/test/functional/es_archives/packetbeat/dns/data.json.gz
diff --git a/x-pack/test/functional/es_archives/packetbeat/dns/mappings.json b/x-pack/test/functional/es_archives/packetbeat/dns/mappings.json
@@ -3403,7 +3403,7 @@
             "dns.question.name",
             "dns.question.type",
             "dns.question.class",
-            "dns.question.etld_plus_one",
+            "dns.question.registered_domain",
             "dns.answers.name",
             "dns.answers.type",
             "dns.answers.class",

diff --git a/x-pack/test/functional/es_archives/packetbeat/overview/data.json.gz b/x-pack/test/functional/es_archives/packetbeat/overview/data.json.gz
diff --git a/x-pack/test/functional/es_archives/packetbeat/overview/mappings.json b/x-pack/test/functional/es_archives/packetbeat/overview/mappings.json
@@ -3160,7 +3160,7 @@
             "dns.question.name",
             "dns.question.type",
             "dns.question.class",
-            "dns.question.etld_plus_one",
+            "dns.question.registered_domain",
             "dns.answers.name",
             "dns.answers.type",
             "dns.answers.class",