Skip to content

[Filebeat] improve logic for network.direction in sophos xg fileset#22973

Merged
leehinman merged 2 commits intoelastic:masterfrom
leehinman:21674_sophos_xg_ingress_egress
Dec 8, 2020
Merged

[Filebeat] improve logic for network.direction in sophos xg fileset#22973
leehinman merged 2 commits intoelastic:masterfrom
leehinman:21674_sophos_xg_ingress_egress

Conversation

@leehinman
Copy link
Copy Markdown
Contributor

What does this PR do?

sets network.direction to "external" when traffic src and dst are in 'WAN' zone

Why is it important?

data accuracy

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
    - [ ] I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=sophos TESTING_FILEBEAT_FILESETS=xg mage -v pythonIntegTest

Related issues

- "external" when traffic src and dst are in 'WAN' zone

Relates elastic#21674
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Dec 8, 2020
@leehinman leehinman added enhancement Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. Team:Security-External Integrations labels Dec 8, 2020
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Dec 8, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Dec 8, 2020

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #22973 updated

  • Start Time: 2020-12-08T15:11:28.768+0000

  • Duration: 44 min 13 sec

Test stats 🧪

Test Results
Failed 0
Passed 2420
Skipped 259
Total 2679

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test Results
Failed 0
Passed 2420
Skipped 259
Total 2679

Copy link
Copy Markdown
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
@leehinman leehinman merged commit db4830b into elastic:master Dec 8, 2020
@leehinman leehinman deleted the 21674_sophos_xg_ingress_egress branch December 8, 2020 15:59
@leehinman leehinman added v7.11.0 and removed needs_backport PR is waiting to be backported to other branches. labels Dec 8, 2020
leehinman added a commit to leehinman/beats that referenced this pull request Dec 9, 2020
…lastic#22973)

* improve logic for network.direction in sophos xg fileset

- "external" when traffic src and dst are in 'WAN' zone

Relates elastic#21674

* Update CHANGELOG.next.asciidoc

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
(cherry picked from commit db4830b)
leehinman added a commit that referenced this pull request Dec 10, 2020
…22973) (#22989)

* improve logic for network.direction in sophos xg fileset

- "external" when traffic src and dst are in 'WAN' zone

Relates #21674

* Update CHANGELOG.next.asciidoc

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
(cherry picked from commit db4830b)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants