Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Improve ECS categorization field mappings for netflow module #18108

Merged
merged 2 commits into from
May 4, 2020
Merged

[Filebeat] Improve ECS categorization field mappings for netflow module #18108

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bda7330
Improve ECS categorization field mappings for netflow module
leehinman Mar 9, 2020
8b62c56
condense setting related.ip
leehinman Apr 29, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,6 +281,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Improve ECS categorization field mappings in rabbitmq module. {issue}16178[16178] {pull}17916[17916]
- Improve ECS categorization field mappings in redis module. {issue}16179[16179] {pull}17918[17918]
- Improve ECS categorization field mappings for zeek module. {issue}16029[16029] {pull}17738[17738]
- Improve ECS categorization field mappings for netflow module. {issue}16135[16135] {pull}18108[18108]

*Heartbeat*

Expand Down
15 changes: 13 additions & 2 deletions x-pack/filebeat/input/netflow/convert.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,9 +66,12 @@ func toBeatEventCommon(flow record.Record) (event beat.Event) {
ecsEvent := common.MapStr{
"created": flow.Timestamp,
"kind": "event",
"category": "network_traffic",
"category": []string{"network_traffic", "network"},
"action": flow.Fields["type"],
}
if ecsEvent["action"] == "netflow_flow" {
ecsEvent["type"] = []string{"connection"}
}
// ECS Fields -- device
ecsDevice := common.MapStr{}
if exporter, ok := getKeyString(flow.Exporter, "address"); ok {
Expand Down Expand Up @@ -155,9 +158,10 @@ func flowToBeatEvent(flow record.Record) (event beat.Event) {
}

flowDirection, hasFlowDirection := getKeyUint64(flow.Fields, "flowDirection")
// ECS Fields -- source and destination
// ECS Fields -- source, destination & related.ip
ecsSource := common.MapStr{}
ecsDest := common.MapStr{}
var relatedIP []net.IP

// Populate first with WLAN fields
if hasFlowDirection {
Expand Down Expand Up @@ -189,6 +193,7 @@ func flowToBeatEvent(flow record.Record) (event beat.Event) {
// Regular IPv4 fields
if ip, found := getKeyIP(flow.Fields, "sourceIPv4Address"); found {
ecsSource["ip"] = ip
relatedIP = append(relatedIP, ip)
ecsSource["locality"] = getIPLocality(ip).String()
}
if sourcePort, found := getKeyUint64(flow.Fields, "sourceTransportPort"); found {
Expand All @@ -201,6 +206,7 @@ func flowToBeatEvent(flow record.Record) (event beat.Event) {
// ECS Fields -- destination
if ip, found := getKeyIP(flow.Fields, "destinationIPv4Address"); found {
ecsDest["ip"] = ip
relatedIP = append(relatedIP, ip)
ecsDest["locality"] = getIPLocality(ip).String()
}
if destPort, found := getKeyUint64(flow.Fields, "destinationTransportPort"); found {
Expand Down Expand Up @@ -313,6 +319,11 @@ func flowToBeatEvent(flow record.Record) (event beat.Event) {
if len(ecsNetwork) > 0 {
event.Fields["network"] = ecsNetwork
}
if len(relatedIP) > 0 {
ecsRelated := common.MapStr{}
ecsRelated["ip"] = relatedIP
event.Fields["related"] = ecsRelated
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
event.Fields["related"] = ecsRelated
event.Fields["related"] = common.MapStr{"ip": relatedIP}

}
return
}

Expand Down
32 changes: 28 additions & 4 deletions ...t/input/netflow/testdata/golden/IPFIX-Barracuda-extended-uniflow-template-256.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2018-04-18T08:16:47Z",
"duration": 0,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "kSpZ1WuBhjc",
Expand Down Expand Up @@ -70,6 +76,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.236.5.4",
"64.235.151.76"
]
},
"source": {
"bytes": 0,
"ip": "10.236.5.4",
Expand All @@ -93,10 +105,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2018-04-18T08:16:47Z",
"duration": 0,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "kSpZ1WuBhjc",
Expand Down Expand Up @@ -151,6 +169,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"64.235.151.76",
"10.236.5.4"
]
},
"source": {
"bytes": 0,
"ip": "64.235.151.76",
Expand Down
128 changes: 112 additions & 16 deletions x-pack/filebeat/input/netflow/testdata/golden/IPFIX-Barracuda-firewall.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2017-06-29T13:58:28Z",
"duration": 20269000000,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "2vFIarATx_4",
Expand Down Expand Up @@ -58,6 +64,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.99.130.239",
"10.99.252.50"
]
},
"source": {
"bytes": 0,
"ip": "10.99.130.239",
Expand All @@ -81,10 +93,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2017-06-29T13:58:28Z",
"duration": 20269000000,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "2vFIarATx_4",
Expand Down Expand Up @@ -127,6 +145,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.99.252.50",
"10.99.130.239"
]
},
"source": {
"bytes": 81,
"ip": "10.99.252.50",
Expand All @@ -150,10 +174,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2017-06-29T13:58:28Z",
"duration": 20306000000,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "wU3G8idsscw",
Expand Down Expand Up @@ -196,6 +226,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.99.130.239",
"10.98.243.20"
]
},
"source": {
"bytes": 0,
"ip": "10.99.130.239",
Expand All @@ -219,10 +255,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2017-06-29T13:58:28Z",
"duration": 20306000000,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "wU3G8idsscw",
Expand Down Expand Up @@ -265,6 +307,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.98.243.20",
"10.99.130.239"
]
},
"source": {
"bytes": 81,
"ip": "10.98.243.20",
Expand All @@ -288,10 +336,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2017-06-29T13:58:28Z",
"duration": 20317000000,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "rOmj8EdZ2dc",
Expand Down Expand Up @@ -334,6 +388,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.99.168.140",
"10.98.243.20"
]
},
"source": {
"bytes": 0,
"ip": "10.99.168.140",
Expand All @@ -357,10 +417,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2017-06-29T13:58:28Z",
"duration": 20317000000,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "rOmj8EdZ2dc",
Expand Down Expand Up @@ -403,6 +469,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.98.243.20",
"10.99.168.140"
]
},
"source": {
"bytes": 113,
"ip": "10.98.243.20",
Expand All @@ -426,10 +498,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2017-06-29T13:58:28Z",
"duration": 20368000000,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "JE7pThaMwJY",
Expand Down Expand Up @@ -472,6 +550,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.99.168.140",
"10.98.243.20"
]
},
"source": {
"bytes": 0,
"ip": "10.99.168.140",
Expand All @@ -495,10 +579,16 @@
},
"event": {
"action": "netflow_flow",
"category": "network_traffic",
"category": [
"network_traffic",
"network"
],
"created": "2017-06-29T13:58:28Z",
"duration": 20368000000,
"kind": "event"
"kind": "event",
"type": [
"connection"
]
},
"flow": {
"id": "JE7pThaMwJY",
Expand Down Expand Up @@ -541,6 +631,12 @@
"observer": {
"ip": "192.0.2.1"
},
"related": {
"ip": [
"10.98.243.20",
"10.99.168.140"
]
},
"source": {
"bytes": 113,
"ip": "10.98.243.20",
Expand Down
Loading