Skip to content

Commit f6fde2e

Browse files
adriansradriansr
authored
[SIEM][CEF] Add support for Check Point devices (#16907)
* Make CEF key name mapping case-insensitive There's some case inconsistency in CEF docs (i.e. C6a4Label). Better to ignore case when mapping keys to full names. * Add missing custom CEF extensions This adds: - `deviceCustomIPv6Address2(Label)`: Only 1, 3 and 4 were expected. - `flexNumber[12](Label)`: These two alternative custom numbers were dropped after V23 of the spec, but still used by some vendors. [Maybe unnecessary] changes: - Changed the case of `DeviceCustomNumber2` from uppercase as documented) to lowercase to align with the other fields. * CEF module: Support Check Point devices This adds a new ingest pipeline and fields to populate from Check Point CEF logs. Closes #16041
1 parent 21be671 commit f6fde2e

17 files changed

Lines changed: 1643 additions & 34 deletions

File tree

‎CHANGELOG.next.asciidoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
186186
- Release ActiveMQ module as GA. {issue}17047[17047] {pull}17049[17049]
187187
- Improve ECS categorization field mappings in iptables module. {issue}16166[16166] {pull}16637[16637]
188188
- Add Filebeat Okta module. {pull}16362[16362]
189+
- Add custom string mapping to CEF module to support Check Point devices. {issue}16041[16041] {pull}NNNN[NNNN]
190+
- Add custom string mapping to CEF module to support Check Point devices. {issue}16041[16041] {pull}16907[16907]
189191

190192
*Heartbeat*
191193

0 commit comments

Comments
 (0)