idaholab#542 add 'public' pseudo-segment for source/destination publi…

…c IP addresses
mmguero-dev · Aug 15, 2024 · 9dee43b · 9dee43b
1 parent dda5718
commit 9dee43b
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/dashboards/dashboards/677ee170-809e-11ed-8d5b-07069f823b6f.json b/dashboards/dashboards/677ee170-809e-11ed-8d5b-07069f823b6f.json
@@ -150,7 +150,7 @@
         "description": "",
         "version": 1,
         "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\"query\":{\"query\":\"source.segment.id:* OR destination.segment.id:*\",\"language\":\"lucene\"},\"filter\":[]}"
+          "searchSourceJSON": "{\"query\":{\"query\":\"source.segment:* OR destination.segment:*\",\"language\":\"lucene\"},\"filter\":[]}"
         },
         "savedSearchRefName": "search_0"
       },

diff --git a/logstash/pipelines/enrichment/11_lookups.conf b/logstash/pipelines/enrichment/11_lookups.conf
@@ -260,12 +260,19 @@ filter {
   } else if ("internal_source" in [tags]) and ("external_destination" in [tags]) {
     mutate { id => "mutate_add_field_metadata_network_direction_outbound"
              add_field => { "[network][direction]" => "outbound" } }
+    mutate { id => "mutate_add_field_direction_outbound_destination_segment"
+             add_field => { "[destination][segment][name]" => "public" } }
   } else if ("external_source" in [tags]) and ("internal_destination" in [tags]) {
     mutate { id => "mutate_add_field_metadata_network_direction_inbound"
              add_field => { "[network][direction]" => "inbound" } }
+    mutate { id => "mutate_add_field_direction_inbound_source_segment"
+             add_field => { "[source][segment][name]" => "public" } }
   } else if ("external_source" in [tags]) and ("external_destination" in [tags]) {
     mutate { id => "mutate_add_field_metadata_network_direction_external"
              add_field => { "[network][direction]" => "external" } }
+    mutate { id => "mutate_add_field_direction_external_segments"
+             add_field => { "[source][segment][name]" => "public"
+                            "[destination][segment][name]" => "public" } }
   } else if ("external_source" in [tags]) or ("external_destination" in [tags]) {
     mutate { id => "mutate_add_field_metadata_network_direction_external_one_sided"
              add_field => { "[network][direction]" => "external" } }