Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[WIP] [Filebeat] Complete Zeek module #12812

Closed
wants to merge 22 commits into from
Closed

[WIP] [Filebeat] Complete Zeek module #12812

wants to merge 22 commits into from

Conversation

0huey
Copy link
Contributor

@0huey 0huey commented Jul 7, 2019 •
edited
Loading

  1. Rename zeek fields following the naming conventions, and write any pipeline processing required
  2. Document the field names in zeek/{fileset}/_meta/fields.yml
  3. Include a sample JSON log for each fileset
  4. Create Kibana visualizations and dashboards for each fileset

I'm going to consider 4 to be a secondary goal and first focus on ingesting data. Here's the progress on 1-3:

  • capture_loss
  • connection
  • dce_rpc
  • dhcp
  • dnp3
  • dns
  • dpd
  • files
  • ftp
  • http
  • intel
  • irc
  • kerberos
  • modbus
  • mysql
  • notice
  • notice_alert
  • ntlm
  • ocsp
  • pe
  • radius
  • rdp
  • rfb
  • signatures
  • sip
  • smb_cmd
  • smb_files
  • smb_mapping
  • smtp
  • snmp
  • socks
  • ssh
  • ssl
  • stats
  • syslog
  • traceroute
  • tunnel
  • weird
  • x509

This is a lot to do, so if someone wants to send me a PR I'll be happy to include your work.

@elasticmachine
Copy link
Collaborator

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

1 similar comment
@elasticmachine
Copy link
Collaborator

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

@elasticcla
Copy link

Hi @Xander33, we have found your signature in our records, but it seems like you have signed with a different e-mail than the one used in your Git commit. Can you please add both of these e-mails into your Github profile (they can be hidden), so we can match your e-mails to your Github profile?

@0huey 0huey closed this Sep 13, 2019
@111andre111 111andre111 mentioned this pull request May 6, 2022
Closed
28 tasks
@andrewkroh andrewkroh mentioned this pull request Jun 1, 2020
Merged
6 tasks
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Jun 1, 2020
@andrewkroh
Remove references to non-existent Zeek signatures fileset
c809cec 
In elastic#13683, a `signatures` fileset is enabled, but it did not exist. This removes
it from the module.d/zeek.yml config file so that the module can start.

In elastic#12812 there was a signatures fileset but that PR never merged. Perhaps
the fileset from that closed PR can be brought into master.

Relates: #18868
andrewkroh added a commit that referenced this pull request Jun 3, 2020
@andrewkroh
Remove references to non-existent Zeek signatures fileset (#18878)
229aee0 
In #13683, a `signatures` fileset is enabled, but it did not exist. This removes
it from the module.d/zeek.yml config file so that the module can start.

In #12812 there was a signatures fileset but that PR never merged. Perhaps
the fileset from that closed PR can be brought into master.

Relates: #18868
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Jun 8, 2020
@andrewkroh
Remove references to non-existent Zeek signatures fileset (elastic#18878
c65edb9 
)

In elastic#13683, a `signatures` fileset is enabled, but it did not exist. This removes
it from the module.d/zeek.yml config file so that the module can start.

In elastic#12812 there was a signatures fileset but that PR never merged. Perhaps
the fileset from that closed PR can be brought into master.

Relates: #18868
(cherry picked from commit 229aee0)
This was referenced Jun 8, 2020
Merged
Merged
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Jun 8, 2020
@andrewkroh
Remove references to non-existent Zeek signatures fileset (elastic#18878
7871474 
)

In elastic#13683, a `signatures` fileset is enabled, but it did not exist. This removes
it from the module.d/zeek.yml config file so that the module can start.

In elastic#12812 there was a signatures fileset but that PR never merged. Perhaps
the fileset from that closed PR can be brought into master.

Relates: #18868
(cherry picked from commit 229aee0)
andrewkroh added a commit that referenced this pull request Jun 8, 2020
@andrewkroh
Remove references to non-existent Zeek signatures fileset (#18878) (#…
9ca2fbd 
…19041)

In #13683, a `signatures` fileset is enabled, but it did not exist. This removes
it from the module.d/zeek.yml config file so that the module can start.

In #12812 there was a signatures fileset but that PR never merged. Perhaps
the fileset from that closed PR can be brought into master.

Relates: #18868
(cherry picked from commit 229aee0)
andrewkroh added a commit that referenced this pull request Jun 8, 2020
@andrewkroh
Remove references to non-existent Zeek signatures fileset (#18878) (#…
718ab29 
…19042)

In #13683, a `signatures` fileset is enabled, but it did not exist. This removes
it from the module.d/zeek.yml config file so that the module can start.

In #12812 there was a signatures fileset but that PR never merged. Perhaps
the fileset from that closed PR can be brought into master.

Relates: #18868
(cherry picked from commit 229aee0)
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
@andrewkroh @melchiormoulin
Remove references to non-existent Zeek signatures fileset (elastic#18878
e7e8e88 
)

In elastic#13683, a `signatures` fileset is enabled, but it did not exist. This removes
it from the module.d/zeek.yml config file so that the module can start.

In elastic#12812 there was a signatures fileset but that PR never merged. Perhaps
the fileset from that closed PR can be brought into master.

Relates: #18868
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@0huey @elasticmachine @elasticcla