Skip to content

Cherry-pick #19494 to 7.8: Fix tls mapping in suricata module#19608

Merged
leehinman merged 1 commit intoelastic:7.8from
leehinman:backport_19494_7.8
Jul 6, 2020
Merged

Cherry-pick #19494 to 7.8: Fix tls mapping in suricata module#19608
leehinman merged 1 commit intoelastic:7.8from
leehinman:backport_19494_7.8

Conversation

@leehinman
Copy link
Copy Markdown
Contributor

@leehinman leehinman commented Jul 2, 2020 •
edited by zube bot
Loading

Cherry-pick of PR #19494 to 7.8 branch. Original message:

What does this PR do?

Fixes tls mappings in suricata module. Specifically:

  • add suricata.eve.tls.ja3s.string field
  • add suricata.eve.tls.ja3s.hash field
  • add suricata.eve.tls.ja3.string field
  • add suricata.eve.tls.ja3.hash field
  • set default_field to false for suricata fields
  • map suricata.eve.tls.ja3.hash to tls.client.ja3
  • map suricata.eve.tls.ja3s.hash to tls.server.ja3s
  • perform suricata.eve.tls.* -> tls.* mappings for all event types

Why is it important?

  • If the tls.* mappings aren't filled in the event doesn't show up in
    the TLS tab in the SIEM
  • default_field to false to stay under 1000 fields

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=suricata mage -v pythonIntegTest

Related issues

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jul 2, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jul 2, 2020

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jul 2, 2020
@leehinman leehinman force-pushed the backport_19494_7.8 branch from da6fe68 to 7bfd05b Compare July 2, 2020 14:22
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jul 2, 2020 •
edited
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [leehinman commented: run tests]

  • Start Time: 2020-07-06T00:47:20.376+0000

  • Duration: 61 min 39 sec

Test stats 🧪

Test Results
Failed 0
Passed 3789
Skipped 683
Total 4472

@leehinman
[Filebeat] Fix tls mapping in suricata module (elastic#19494)
ef7ebb9 
* Fix tls mapping in suricata module

- add suricata.eve.tls.ja3s.string field
- add suricata.eve.tls.ja3s.hash field
- add suricata.eve.tls.ja3.string field
- add suricata.eve.tls.ja3.hash field
- set default_field to false for ja3 & ja3s fields
- map suricata.eve.tls.ja3.hash to tls.client.ja3
- map suricata.eve.tls.ja3s.hash to tls.server.ja3s
- perform suricata.eve.tls.* -> tls.* mappings for all event types

Closes elastic#19492

(cherry picked from commit afffe2b)
@leehinman leehinman force-pushed the backport_19494_7.8 branch from 7bfd05b to ef7ebb9 Compare July 2, 2020 15:42
@leehinman
Copy link
Copy Markdown
Contributor Author

leehinman commented Jul 6, 2020

run tests

@leehinman leehinman merged commit 0f2144a into elastic:7.8 Jul 6, 2020
@leehinman leehinman deleted the backport_19494_7.8 branch October 5, 2020 19:06
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
@leehinman
[Filebeat] Fix tls mapping in suricata module (elastic#19494) (elasti…
da3007a 
…c#19608)

* Fix tls mapping in suricata module

- add suricata.eve.tls.ja3s.string field
- add suricata.eve.tls.ja3s.hash field
- add suricata.eve.tls.ja3.string field
- add suricata.eve.tls.ja3.hash field
- set default_field to false for ja3 & ja3s fields
- map suricata.eve.tls.ja3.hash to tls.client.ja3
- map suricata.eve.tls.ja3s.hash to tls.server.ja3s
- perform suricata.eve.tls.* -> tls.* mappings for all event types

Closes elastic#19492

(cherry picked from commit 362016d)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marc-gr marc-gr marc-gr approved these changes

Assignees

No one assigned

Labels

backport [zube]: Done

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@leehinman @elasticmachine @marc-gr