Skip to content

[zeek] - Modified field definitions to use ECS #8062

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 3, 2023
Merged

[zeek] - Modified field definitions to use ECS #8062

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/zeek/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: 2.18.0
changes:
- description: Modified the field definitions to reference ECS where possible and remove invalid field attributes.
type: enhancement
link: https://github.com/elastic/integrations/pull/8062
- version: 2.17.0
changes:
- description: ECS version updated to 8.10.0.
Expand Down
145 changes: 23 additions & 122 deletions packages/zeek/data_stream/capture_loss/fields/agent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,171 +1,72 @@
- name: cloud
title: Cloud
group: 2
description: Fields related to the cloud or infrastructure the events are coming from.
footnote: "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on."
type: group
fields:
- name: account.id
level: extended
type: keyword
ignore_above: 1024
description: "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier."
example: 666777888999
external: ecs
- name: availability_zone
level: extended
type: keyword
ignore_above: 1024
description: Availability zone in which this host is running.
example: us-east-1c
external: ecs
- name: instance.id
level: extended
type: keyword
ignore_above: 1024
description: Instance ID of the host machine.
example: i-1234567890abcdef0
external: ecs
- name: instance.name
level: extended
type: keyword
ignore_above: 1024
description: Instance name of the host machine.
external: ecs
- name: machine.type
level: extended
type: keyword
ignore_above: 1024
description: Machine type of the host machine.
example: t2.medium
external: ecs
- name: provider
level: extended
type: keyword
ignore_above: 1024
description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
example: aws
external: ecs
- name: region
level: extended
type: keyword
ignore_above: 1024
description: Region in which this host is running.
example: us-east-1
external: ecs
- name: project.id
type: keyword
description: Name of the project in Google Cloud.
external: ecs
- name: image.id
type: keyword
description: Image ID for the cloud instance.
- name: container
title: Container
group: 2
description: "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime."
type: group
fields:
- name: image.name
level: extended
type: keyword
ignore_above: 1024
description: Name of the image the container was built on.
external: ecs
- name: labels
level: extended
type: object
object_type: keyword
description: Image labels.
external: ecs
- name: name
level: extended
type: keyword
ignore_above: 1024
description: Container name.
external: ecs
- name: host
title: Host
group: 2
description: "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes."
type: group
fields:
- name: architecture
level: core
type: keyword
ignore_above: 1024
description: Operating system architecture.
example: x86_64
external: ecs
- name: domain
level: extended
type: keyword
ignore_above: 1024
description: "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider."
example: CONTOSO
default_field: false
external: ecs
- name: hostname
level: core
type: keyword
ignore_above: 1024
description: "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
external: ecs
- name: id
level: core
type: keyword
ignore_above: 1024
description: "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
external: ecs
- name: mac
level: core
type: keyword
ignore_above: 1024
description: Host mac addresses.
external: ecs
- name: name
level: core
type: keyword
ignore_above: 1024
description: "Name of the host.\nIt can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use."
external: ecs
- name: os.family
level: extended
type: keyword
ignore_above: 1024
description: OS family (such as redhat, debian, freebsd, windows).
example: debian
external: ecs
- name: os.kernel
level: extended
type: keyword
ignore_above: 1024
description: Operating system kernel version as a raw string.
example: 4.4.0-112-generic
external: ecs
- name: os.name
level: extended
type: keyword
ignore_above: 1024
multi_fields:
- name: text
type: text
norms: false
default_field: false
description: Operating system name, without the version.
example: Mac OS X
external: ecs
- name: os.platform
level: extended
type: keyword
ignore_above: 1024
description: Operating system platform (such centos, ubuntu, windows).
example: darwin
external: ecs
- name: os.version
level: extended
type: keyword
ignore_above: 1024
description: Operating system version as a raw string.
example: 10.14.1
external: ecs
- name: type
level: core
type: keyword
ignore_above: 1024
description: "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
external: ecs
- name: containerized
type: boolean
description: >
If the host is a container.

- name: os.build
type: keyword
example: "18D109"
description: >
OS build information.

- name: os.codename
type: keyword
example: "stretch"
description: >
OS codename, if any.

14 changes: 5 additions & 9 deletions packages/zeek/data_stream/capture_loss/fields/base-fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,9 @@
- name: data_stream.type
type: constant_keyword
description: Data stream type.
external: ecs
- name: data_stream.dataset
type: constant_keyword
description: Data stream dataset.
external: ecs
- name: data_stream.namespace
type: constant_keyword
description: Data stream namespace.
external: ecs
- name: event.module
type: constant_keyword
description: Event module
Expand All @@ -15,6 +12,5 @@
type: constant_keyword
description: Event dataset
value: zeek.capture_loss
- name: '@timestamp'
type: date
description: Event timestamp.
- name: "@timestamp"
external: ecs
20 changes: 6 additions & 14 deletions packages/zeek/data_stream/capture_loss/fields/beats.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,15 @@
- description: Unique container id.
ignore_above: 1024
name: container.id
type: keyword
- name: container.id
external: ecs
- description: Type of Filebeat input.
name: input.type
type: keyword
- description: Full path to the log file this event came from.
example: /var/log/fun-times.log
ignore_above: 1024
name: log.file.path
type: keyword
- name: log.file.path
external: ecs
- description: Flags for the log file.
name: log.flags
type: keyword
- description: Offset of the entry in the log file.
name: log.offset
type: long
- description: List of keywords used to tag each event.
example: '["production", "env2"]'
ignore_above: 1024
name: tags
type: keyword
- name: tags
external: ecs
Loading