[Filebeat] zeek ecs 1.7 updates for network.direction#22967
[Filebeat] zeek ecs 1.7 updates for network.direction#22967leehinman merged 2 commits intoelastic:masterfrom
Conversation
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
- prevent setting network.direction to external if local_orig and local_resp are both undefined
ea763c8 to
0a768e5
Compare
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. Expand to view the summary
Test stats 🧪
|
| return; | ||
| } | ||
| if (ctx.zeek.connection.local_orig == false && | ||
| ctx.zeek.connection.local_resp == false) { |
There was a problem hiding this comment.
So, wondering what these fields equate to in practice? I'm assuming that they're generally about inbound/outbound network connections that are destined for the host that zeek is running on, right? If so, I'd actually switch this to use ingress/egress. The inbound/outbound stuff is when you're modeling around a network perimeter, like if you have a network firewall or something.
There was a problem hiding this comment.
From zeek docs:
local_orig: bool
If the connection is originated locally, this value will be T. If it was originated remotely it will be F. In the case that the Site::local_nets variable is undefined, this field will be left empty at all times.
local_resp: bool
If the connection is responded to locally, this value will be T. If it was responded to remotely it will be F. In the case that the Site::local_nets variable is undefined, this field will be left empty at all times.
So I think inbound/outbound are the right pairs, since you have to define local_nets variable and traffic doesn't have to be to/from the zeek host.
- prevent setting network.direction to external if local_orig and local_resp are both undefined (cherry picked from commit f0120ce)
What does this PR do?
prevents setting network.direction to external if local_orig and local_resp are both undefined
Why is it important?
data accuracy
Checklist
- [ ] I have commented my code, particularly in hard-to-understand areas- [ ] I have made corresponding changes to the documentation- [ ] I have made corresponding change to the default configuration filesCHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.How to test this PR locally
Related issues