I looked through the Security Ingest modules/beats for comments and TODOs indicating that a change was needed for 8.0. This may not be an exhaustive list so if you know of change that should be made for 8.0 please add it hear.
Winlogbeat
Auditbeat
Packetbeat
|
// remove this in 8.x |
|
"version": cert.Version, |
|
// remove this in 8.x |
|
{"province", name.Province}, |
|
fields.Put("tls.detailed", detailed) |
|
if cert, ok := detailed["client_certificate"]; ok { |
|
fields.Put("tls.client.x509", cert) |
|
} |
|
if cert, ok := detailed["server_certificate"]; ok { |
|
fields.Put("tls.server.x509", cert) |
|
Category: []string{"network_traffic", "network"}, |
Filebeat
|
# The following copies values from dns namespace (ECS) to the coredns |
|
# namespace to avoid introducing breaking change. This should be removed |
|
# for 8.0.0. Additionally coredns.dnssec_ok can be removed. |
|
- set: |
|
field: coredns.id |
|
value: '{{dns.id}}' |
|
ignore_empty_value: true |
|
- set: |
|
field: coredns.query.class |
|
value: '{{dns.question.class}}' |
|
ignore_empty_value: true |
|
- set: |
|
field: coredns.query.name |
|
value: '{{dns.question.name}}' |
|
ignore_empty_value: true |
|
- set: |
|
field: coredns.query.type |
|
value: '{{dns.question.type}}' |
|
ignore_empty_value: true |
|
- set: |
|
field: coredns.response.code |
|
value: '{{dns.response_code}}' |
|
ignore_empty_value: true |
|
- script: |
|
if: ctx.dns?.header_flags != null |
|
lang: painless |
|
source: > |
|
ctx.coredns.response.flags = ctx.dns.header_flags; |
I looked through the Security Ingest modules/beats for comments and TODOs indicating that a change was needed for 8.0. This may not be an exhaustive list so if you know of change that should be made for 8.0 please add it hear.
Winlogbeat
Remove hash.* fields
beats/x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js
Lines 428 to 429 in d11d609
Remove the eventlogging API reader implementation.
beats/winlogbeat/eventlog/eventlogging.go
Line 281 in d81ef73
Auditbeat
Remove auditd module event categories [Auditbeat] Field cleanup for 8.0 #28378
beats/auditbeat/module/auditd/audit_linux.go
Line 579 in bd7414d
Remove FIM
hash.*fields [Auditbeat] Field cleanup for 8.0 #28378beats/auditbeat/module/file_integrity/event.go
Lines 308 to 309 in 56ba9d0
beats/auditbeat/module/file_integrity/event_test.go
Lines 318 to 320 in 56ba9d0
Packetbeat
versionandprovincefields Remove deprecated TLS fields #28487beats/packetbeat/protos/tls/parse.go
Lines 574 to 575 in 00b41c3
beats/packetbeat/protos/tls/parse.go
Lines 607 to 608 in 00b41c3
detailed.client_certificateanddetailed.server_certificatein favor ofx509fields Remove deprecated TLS fields #28487beats/packetbeat/protos/tls/tls.go
Lines 445 to 450 in 00b41c3
network_trafficECS category:beats/packetbeat/pb/event.go
Line 80 in 00b41c3
Filebeat
beats/x-pack/filebeat/module/coredns/log/ingest/pipeline-entry.yml
Lines 75 to 102 in 6e69b05